Lampion Malware Targets Portugal via Phishing Campaign Delivering Multistage RAT

Portuguese users are once again in the crosshairs of Lampion, a long-running banking malware family that has spent years quietly refining its ability to slip past defenders while staying laser-focused on a single national audience.

New research from Acronis’ Threat Research Unit (TRU) reveals that the malware’s latest campaign leans harder than ever into obfuscation, fragmenting its attack across multiple independent stages to frustrate both automated detection and human analysis.

Lampion isn’t new. First documented publicly in December 2019, the malware traces its lineage to the ChePro family of Brazilian banking trojans. But despite its Brazilian roots, Lampion has consistently ignored Brazilian targets in favor of Portugal and other Portuguese-speaking populations, a targeting choice that has held remarkably steady for over six years.

Lampion Malware Targets Portugal via Phishing

The current wave, tracked by Acronis TRU through June 2026, confirms that pattern with striking precision: 94.6% of detections originate in Portugal, with Spain (4.3%) and the UK (1.1%) picking up only incidental spillover.

The infection begins with phishing emails disguised as routine financial or administrative correspondence, often referencing a “payment receipt” to pressure recipients into opening an attachment.

These messages are padded with credibility markers confidentiality notices, automated mailbox disclaimers, full business signatures mimicking legitimate corporate communication.

The payload arrives as a ZIP archive containing a bloated HTML file, artificially inflated to roughly 1.3MB through nonsensical markup and randomized strings. Opening it renders a convincing fake SAPO Transfer page, abusing the branding of Portugal’s widely used Altice-operated internet portal, a tactic Lampion has recycled from previous campaigns.

Behind the fake webpage, embedded JavaScript quietly fetches an encrypted next-stage payload from attacker infrastructure, dynamically injecting it into the page. This kicks off a layered VBScript infection chain:

Second-stage VBS: Disguised with the same document-style naming convention, this script (roughly 7MB, but only ~22KB of real code) builds a downloader and schedules a task to fetch the final stage.
Final-stage VBS: The most complex component, spanning ~1,000 lines after deobfuscation. It fingerprints the victim machine (user, host, BIOS, motherboard, GPU) to generate a unique bot ID, checks in with command-and-control infrastructure, and downloads the final payload in 10MB HTTP range chunks, reassembling it via ADODB.Stream.

Each layer wipes competing artifacts, avoids duplicate execution, and schedules its own persistence, making the chain difficult to reconstruct from any single snapshot.

The final payload is a DLL executed via rundll32, invoking an exported function named jangadeiro, Portuguese for a raft fisherman, a linguistic fingerprint pointing back to the malware’s Brazilian developers.

Telemetry shows this DLL ballooning to roughly 750MB, almost entirely junk padding rather than functional code, consistent with prior reporting of Lampion loaders exceeding 700MB.

“What stands out in this campaign isn’t novel exploitation it’s discipline. Lampion’s operators have essentially industrialized obfuscation, treating file bloat and chain fragmentation as a detection-evasion strategy rather than an afterthought. That level of consistency over multiple campaign waves suggests a mature, well-resourced operation rather than opportunistic cybercrime.”

Lampion’s persistence illustrates a broader trend: threat actors don’t always need novel exploits to remain effective; patient refinement of delivery and evasion can be just as dangerous.

Security teams monitoring Portuguese-speaking regions should treat oversized HTML/VBS attachments, SAPO-branded lures, and scheduled-task anomalies as high-priority indicators.