Zscaler ThreatLabz found an AI-generated typosquatting campaign impersonating a Brazilian bank that used a ClickFix lure to trick victims into running PowerShell and installing the banking RAT SmartRAT. SmartRAT supports encrypted C2, keylogging, screen and QR-code manipulation, and persistence through Windows services and scheduled tasks, while the attacker’s web-based C2 panel also had a localStorage-based authentication bypass. #SmartRAT #ClickFix #Zscaler #ThreatLabz #BananaRAT
Keypoints
- ThreatLabz observed multiple typosquatting domains hosting malicious AI-generated websites in March 2026.
- A fake Brazilian bank site used a ClickFix flow with a fake CAPTCHA and BSOD-style recovery page to pressure victims into running PowerShell commands.
- The infection chain downloaded and executed a PowerShell-based RAT that Zscaler named SmartRAT; Trend Micro separately referred to the family as Banana RAT.
- SmartRAT is designed for banking fraud and remote access, including keylogging, fake bank forms, QR code interception, and screen/keyboard/mouse control.
- The malware uses encrypted C2 communications, multiple persistence mechanisms, and fallback infrastructure including a hardcoded IP address.
- ThreatLabz found a flaw in the AI-generated C2 panel where client-side localStorage checks could be bypassed to access the interface.
- Zscaler identified this campaign under the threat names PS.RAT.SmartRAT and HTML.Phish.Typosquat.RC.M.TS.
MITRE Techniques
- [T1566 ] Phishing – Used a fake bank website and ClickFix lure to trick victims into executing malicious commands [‘a fake CAPTCHA followed by a fullscreen fake BSOD/system recovery prompt’]
- [T1059 ] Command and Scripting Interpreter – Used PowerShell to download and execute the next stage [‘run a PowerShell command that downloads and executes a RAT’]
- [T1059.001 ] PowerShell – SmartRAT and its loaders were implemented in PowerShell [‘SmartRAT is a PowerShell-based banking RAT’]
- [T1569.002 ] Service Execution – Used service-related behavior to run payloads and support SYSTEM execution [‘compiles inline C# service code using csc.exe and installs a Windows service’]
- [T1543.003 ] Create or Modify System Process: Windows Service – Created a Windows service for persistence and SYSTEM execution [‘installs a Windows service named MicrosoftEdgeUpdateCore under %ProgramData%… configured to run with System privileges’]
- [T1036 ] Masquerading – Used bank and update-themed names to appear legitimate [‘MicrosoftEdgeUpdateCore’, ‘msedgeupdate.txt’, and bank impersonation lures’]
- [T1070.004 ] Indicator Removal: File Deletion – Deleted files, logs, and cleanup artifacts during uninstall/self-removal [‘delete the service, scheduled tasks, registry keys, and all files’]
- [T1082 ] System Information Discovery – Collected OS, username, host, privilege, session ID, and other victim details [‘Sends victim profile JSON (OS, username, host, privilege, session ID, install token, HMAC)’]
- [T1071 ] Application Layer Protocol – Used HTTP and TCP-based C2 communications to blend with normal traffic [‘retrieving st.txt from 64.95.13.238’ and ‘communicates over a raw TCP socket on port 51888’]
Indicators of Compromise
- [Domains] fraudulent bank and lure infrastructure – cartaobb[.]com, cartaobrb[.]com[.]br, crefisa[.]online, and 1 more domain
- [Domains] C2 and payload infrastructure – windowsupdate-cdn[.]com, vfsgloball[.]net
- [IP addresses] payload delivery and fallback C2 – 64[.]95[.]13[.]238, 162[.]141[.]111[.]227
- [File names] loader and payload files – st.txt, payload.php, msedge.txt, install.token, etw.dat
- [File hashes] sample and component hashes mentioned in the IOC list – 297eb45f028d44d750297d2f932b9c91, 6bf4d4c62b5138ace281ce3d08297787, and 2 more hashes
- [Ports] SmartRAT C2 communication – 51888
- [Registry keys] persistence location – HKCUSoftwareMicrosoftWindowsCurrentVersionRun
- [Windows paths] log and payload storage locations – C:ProgramDataMicrosoftDiagnosisETWclient_debug.log, %TEMP%client_debug.log, C:UsersPublicDocumentsmsedge.txt
Read more: https://www.zscaler.com/blogs/security-research/clickfix-campaign-generated-ai-delivers-smartrat