Critical Flaw in PowerShell Commands Lets Attackers Deliver SmartRAT

Key Takeaways

• A sophisticated phishing campaign, dubbed “ClickFix,” is targeting Brazilian banking customers.
• The attack leverages AI-generated phishing pages and social engineering to trick victims into executing malicious PowerShell commands.
• The campaign delivers SmartRAT, a full-featured PowerShell-based remote access trojan capable of extensive data theft and system control.
• Researchers discovered that even the attackers’ command-and-control (C2) panel was likely AI-built, exhibiting significant security flaws.

A new, highly deceptive cyberattack campaign is actively deploying the potent SmartRAT malware against customers of Brazilian banks. This operation distinguishes itself by combining advanced social engineering tactics with phishing pages potentially generated by artificial intelligence, creating an unusually convincing threat landscape.

Security researchers highlight this campaign as a significant evolution in attacker methodologies, particularly concerning the development and deployment of malicious infrastructure. The attackers meticulously crafted a fraudulent website, impersonating a prominent Brazilian financial institution, featuring a realistic credit card application and a fake security verification prompt.

Victims interacting with the counterfeit page are then manipulated into executing a malicious PowerShell command. This command surreptitiously downloads and installs SmartRAT, a versatile remote access trojan designed for extensive data exfiltration, including keystroke logging, screenshot capture, QR code interception, and the display of full-screen fake banking forms to steal credentials.

Analysts from Zscaler ThreatLabz, who identified this campaign in March 2026, indicated in a report shared with Cyber Security News (CSN) that the fraudulent web pages likely originated from AI-powered website creation tools. Evidentiary clues within the page source, such as templated section comments and automated structural elements, suggest AI generation.

The campaign’s efficacy stems from its layered deception. Initially, the phishing page presents a convincing fake Cloudflare CAPTCHA. Subsequently, it triggers a simulated Blue Screen of Death (BSOD), a technique known as “ClickFix.” This maneuver is designed to induce panic, coercing victims into believing their system has crashed and that executing a specific command is the sole remedy for recovery.

SmartRAT itself is a robust remote access tool, developed entirely in PowerShell, granting deep control over compromised systems. It actively monitors browser activity for banking-related interactions, alerting its operators when a victim accesses financial applications or websites. Upon detection, the attacker can seize control of the victim’s screen, inject keystrokes, disable user input, and exfiltrate any entered data.

Hackers Abuse PowerShell Commands

The infection chain begins subtly. The malicious web page silently injects a PowerShell command into the victim’s clipboard. When prompted by the fake BSOD, the victim pastes this command into the Windows Run dialog, unknowingly initiating the malware deployment. This command connects to a remote server at 64.95.13.238 to fetch a file named “st.txt,” which functions as a hidden dropper.

The dropper then retrieves a second file, “payload.php,” containing an AES-encrypted PowerShell script. This script is responsible for decrypting, unpacking, and executing the SmartRAT malware. SmartRAT employs stealth techniques, disguising its files and scheduled tasks with names resembling legitimate Microsoft Edge update processes to evade detection.

The malware attempts to escalate privileges by prompting for User Account Control (UAC) approval. If granted, it establishes itself as a Windows service with SYSTEM-level access. Should the user deny the UAC request, SmartRAT maintains persistence through a hidden PowerShell process and a registry-based startup entry, ensuring continued access to the compromised system.

AI-Built Infrastructure and a Critically Flawed C2 Panel

A notable finding by researchers is the apparent use of AI tools in constructing the attackers’ command-and-control (C2) panel – the web interface used to manage compromised machines. Analysis revealed a client-side only login system, allowing anyone to bypass authentication by simply manipulating two values in the browser’s local storage. This fundamental security oversight points to code developed without adequate review, likely a byproduct of rapid, AI-assisted development processes.

The C2 panel, branded “MyGood PRO,” offers operators a live dashboard of connected victims and real-time command execution capabilities. Attackers can stream victim screens, swap QR codes on banking pages to divert payment transactions, and inject fraudulent bank verification forms to harvest credentials. The platform specifically targets over a dozen Brazilian banks and payment services, indicating a well-resourced and focused operation.

What You Should Do

• Exercise Extreme Caution: Be highly suspicious of any website, even those appearing legitimate, that instructs you to paste commands into your operating system’s command prompt or run dialog.
• Verify Website Authenticity: Always double-check the URL of banking and financial websites. Bookmark legitimate sites and use those bookmarks rather than clicking links from emails or untrusted sources.
• Enable Endpoint Protection: Ensure your endpoint detection and response (EDR) solutions are up-to-date and configured to monitor for unusual PowerShell execution, unexpected scheduled tasks, and suspicious outbound network connections.
• Implement Multi-Factor Authentication (MFA): Enable MFA on all banking and critical accounts to add an essential layer of security, even if credentials are compromised.
• Educate Users: Conduct regular security awareness training for employees, emphasizing the dangers of social engineering, phishing, and the importance of verifying requests before acting.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.