A sophisticated Lampion RAT campaign is targeting Portuguese organizations through phishing emails disguised as payment receipts, delivering an unusually large 750MB trojan payload designed to evade detection. Security researchers at Acronis have identified this ongoing attack wave, which shows that 94.6 percent of detections occurred in Portugal, demonstrating the attackers’ geographic focus and use of localized social engineering tactics.
Lampion represents a Brazilian banking malware family first documented in 2019 and connected to the ChePro lineage. Despite its Brazilian origins, operators have consistently targeted Portuguese-speaking victims through carefully crafted scams that increase the credibility of malicious messages.
How Does the Multi-Stage Attack Unfold?
The infection begins with phishing emails posing as routine financial or administrative communications. Recipients receive messages that urge them to open ZIP attachments appearing to contain payment receipts, transforming a common business task into the initial infection vector.
One observed attachment was named COMPROVATIVO-JUNHO_OJLWnObxFOyTZkx_01-06-2026_104.zip. Inside, attackers placed an approximately 1.3MB HTML document padded with meaningless code and random strings, a deliberate tactic intended to complicate inspection and avoid matching common detection signatures.
When victims open the HTML file, they see a fake SAPO Transfer page imitating a trusted Portuguese online service. This visual deception reassures targets while hidden JavaScript retrieves the next malware stage without obvious warning signs. The downloaded JavaScript executes automatically, continuing the infection process.
What Makes This Campaign Distinctive?
The campaign employs multiple Visual Basic Script stages before deploying the final payload. VBS files carry names maintaining the payment-document theme, including Comprovativo_Junho_15-06-2026-WjGAxGL.vbs. These scripts are heavily padded with junk data—one analyzed file measured approximately 7MB despite containing only around 22KB of functional code.
This file size inflation serves a dual purpose: concealing malicious behavior while complicating both automated and manual security reviews. The final VBS component performs victim checks, collects system information, and contacts command-and-control infrastructure for payload delivery.
How Is the 750MB Payload Delivered?
The malware downloads a DLL into a timestamp-named folder under the user’s AppData directory. Using HTTP range requests, it retrieves the file in 10MB pieces, then rebuilds it locally before scheduling execution through rundll32. The final DLL measures approximately 750MB, though researchers attribute much of this size to junk padding rather than genuine complexity.
This padding represents a long-used Lampion tactic that makes the payload harder to scan, transfer, and analyze. Once launched, the DLL uses an exported function named jangadeiro and functions as the primary remote access trojan, granting attackers system access and enabling data theft.
What Should Defenders Monitor?
Security teams should investigate unusually large DLL files appearing in AppData directories, particularly those stored in timestamp-named folders. Scheduled tasks utilizing cmd /c move, rundll32, or VBS files in temporary folders warrant examination, as do suspicious outbound connections associated with payment-themed attachments.
Organizations should verify unexpected receipts with senders through separate trusted channels before opening attachments. While attachment scanning and sandboxing provide protection, analysts must recognize that geofencing and victim checks may prevent malicious files from revealing full behavior during single tests.
The campaign demonstrates how older banking malware remains effective when attackers refine delivery mechanisms. By spreading infections across several stages and using localized lures with familiar financial language, convincing business details, and credibility markers such as confidentiality notices and business addresses, operators successfully blend malicious communications into normal corporate traffic.
Source: Cybersecurity News