Lampion Malware Targets Portuguese Users With Multistage Phishing and 750MB RAT Payload

A highly targeted Lampion malware campaign abusing localized phishing lures to compromise users in Portugal.

The activity reflects a continued evolution of the Brazilian-origin banking trojan, first documented in 2019, which has consistently focused on Portuguese-speaking victims rather than domestic Brazilian targets.

In the latest campaign, attackers leverage convincing financial-themed phishing emails masquerading as routine business communications, including payment receipts and administrative notices.

The emails are crafted in Portuguese and include realistic business signatures, confidentiality disclaimers, and branding elements to increase credibility.

The infection begins with a ZIP archive attachment containing an inflated HTML file of approximately 1.3MB. The file is deliberately padded with junk markup and randomized strings to evade static detection mechanisms.

When opened, the HTML renders a spoofed SAPO file transfer interface abusing the branding of Portugal’s widely used online service portal to trick victims into interacting with the content.

Behind the interface, embedded JavaScript initiates the next stage by retrieving a remote payload from attacker-controlled infrastructure.

One observed URL, resolved from an obfuscated string, points to hxxps://fat-contabislitaca[.]com/js/1898.php. The script dynamically injects the downloaded code into the browser session, enabling execution without writing immediately suspicious files to disk.

The second stage introduces heavily obfuscated Visual Basic Script (VBS) payloads, often exceeding 7MB in size while containing only minimal functional code.

These scripts maintain naming conventions aligned with the phishing lure, such as “Comprovativo_Junho,” reinforcing the illusion of legitimacy.

Once executed, the VBS establishes persistence by creating scheduled tasks and generating additional downloader scripts within the system’s temporary directory.

The final stage of the infection chain is significantly more complex, comprising roughly 1,000 lines of deobfuscated logic. It enforces single-instance execution via WMI, removes competing scripts, and generates a unique victim identifier derived from system attributes such as BIOS, GPU, and hostname.

Acronis Threat Research Unit (TRU) said in a report shared with GBhackers, identified an active Lampion, derived from the ChePro malware lineage, is known for its modular, multi-stage infection architecture and heavy reliance on obfuscation to evade analysis.

The malware communicates with its command-and-control (C2) server using this fingerprint, transmitting encoded telemetry including antivirus presence and system metadata.

Lampion Malware Targets Portuguese

A key characteristic of this stage is its chunked payload delivery mechanism. The malware downloads its final payload a DLL-based remote access trojan in 10MB segments using HTTP range requests.

These fragments are reassembled locally using ADODB.Stream before execution via rundll32, invoking the exported function “jangadeiro,” a reference consistent with the malware’s Brazilian origins.

Notably, the final payload reaches an unusually large size of approximately 750MB. Analysis suggests this is primarily due to excessive junk padding rather than functional complexity, a tactic designed to hinder sandboxing and automated analysis systems.

Security teams should monitor for suspicious ZIP-delivered HTML attachments, anomalous VBS execution chains, and large outbound HTTP range-based downloads.

Similar oversized loaders have been observed in prior Lampion campaigns, indicating a consistent anti-analysis strategy.

Telemetry data shows that 94.6% of detections are concentrated in Portugal, with minor spillover observed in Spain and the United Kingdom.

This geographic skew reinforces the assessment that the campaign is highly targeted, leveraging localized language and trusted brand impersonation to maximize infection success.

The Lampion campaign underscores a broader trend in financially motivated malware operations: combining social engineering precision with layered technical obfuscation.

By fragmenting execution across multiple stages and inflating payload sizes, attackers significantly reduce visibility for defenders relying on traditional detection methods.

The continued abuse of trusted regional brands such as SAPO highlights the importance of user awareness alongside technical controls.

Indicators of Compromise (IoCs)

Category	SHA-256 Hash
Phishing Email	87efeada5fe39a94cefc6151fd84af223d0e0e2b070daec606274481ed87b87b
Phishing Email	ab46f7c4d3f717bb1e61d2f236917976d2a85be6958ae099fee79ea6e9031e37
ZIP Attachment	b1c101bd1ba134ffbea61f9fac2b7c8fbd13ca113a37944abdc131ef86da92ac
ZIP Attachment	c6618bb692fb3f5d7959f8db1fedaaac5e8a36fb901397a008aa2b88874448fd
HTML File	036c8f32012abdcb9a389ae9c284da89505e830bca74eb1aa9ea3794b067aab6
HTML File	d25d32478ae67403484a309591b6409224d26ca3d094c5ccd8428ebef7efcfd1
HTML File	643c0093baec45952a46b0210f7a6f8fb26883b396b66f1cb609c5b55e6dae1e
HTML File	050e84d134a32ed7c4885a9d57ce37f8ae5f910960b67e2156941961bd5781ba

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist