Acronis Researchers Uncover Active Lampion Malware Campaign Targeting Portugal With Multi-Stage Evasion Chain

The Acronis Threat Research Unit (TRU) has identified an active campaign by the Lampion malware family targeting Portuguese users through phishing emails that impersonate financial and administrative communications.

The campaign concentrates 94.6 per cent of its detections in Portugal, using a multi-stage infection chain spanning HTML, JavaScript and VBS components designed to reduce security visibility at each step. The final payload deploys a remote access trojan (RAT) capable of data exfiltration and full remote access to compromised machines.

While the campaign is focused on Portugal, TRU notes the tactics observed reflect broader trends security teams are facing globally, including across Australia and New Zealand.

What Is Lampion

Lampion is a Brazilian banking malware family derived from the ChePro lineage, first publicly documented in December 2019. Unlike many Brazilian banking trojans, Lampion has consistently targeted Portugal and other Portuguese-speaking users rather than Brazilian victims.

The latest campaign follows this established pattern. Spain accounted for 4.3 per cent of detections and the United Kingdom for 1.1 per cent. The researchers assess these as likely incidental spillover rather than deliberate targeting.

The Phishing Lure

The campaign uses phishing emails that impersonate routine financial documents such as payment receipts. The messages include credibility markers typical of legitimate business communication – confidentiality notices, automated mailbox disclaimers and full business signatures with addresses and social media links.

The malicious attachment arrives as a ZIP file containing an HTML document of approximately 1.3 MB, artificially inflated with nonsensical markup and randomised strings intended to hinder analysis.

When opened in a browser, the HTML file renders a fake SAPO Transfer page. SAPO is a Portuguese internet portal operated by Altice Portugal that offers email, news and online tools. Impersonation of SAPO branding has appeared in prior Lampion campaigns.

Multi-Stage Infection Chain

The infection chain progresses through several distinct stages, each employing obfuscation to complicate detection and analysis.

In the first stage, malicious JavaScript embedded in the fake SAPO page retrieves the next payload from an encrypted URL. Once downloaded, the script is dynamically injected into the loaded page and executed by creating a new script element, assigning the downloaded content to its textContent property and appending it to the page’s head section.

TRU assesses with moderate confidence that the campaign’s infrastructure employs geofencing or victim-tracking mechanisms to restrict payload delivery. This makes obtaining the next-stage payload outside of a live infection chain difficult.

Second-Stage VBS

The second stage uses VBS scripts that follow the same naming convention as the earlier ZIP archives and HTML lures, maintaining the appearance of legitimate financial documents. These scripts are obfuscated. The sample analysed was approximately 7 MB in size despite containing only around 22 KB of actual code. The rest consists of junk variables, unnecessary functions and encoded strings designed to inflate the file and evade signature-based detection.

After deobfuscation, TRU determined this stage performs two functions: it dynamically constructs a downloader script and writes it to the system’s temporary directory, and it creates a scheduled task to orchestrate the download and execution of the final VBS stage.

Final VBS Stage

The final VBS stage is the most technically complex component in the chain. After removing obfuscation layers, the core logic spans approximately 1,000 lines.

It enforces a single running instance via Windows Management Instrumentation, wipes other VBS files in the temporary directory and computes a unique victim identifier from system information including user, host, BIOS, motherboard and GPU data. This identifier serves as the bot ID when communicating with command-and-control infrastructure.

The stage checks whether a previously downloaded payload exists. If not, it polls a C2 URL to obtain a download URL and payload name. It downloads the payload in 10 MB HTTP range chunks, reassembles them using ADODB.Stream, then schedules tasks to move the file to its final destination. A Base64-encoded analytics beacon containing host information, antivirus product details and machine fingerprint data is sent to the C2. The stage then schedules a delayed self-restart task set for five minutes later.

The Final Payload

The final DLL payload is deployed into the user’s AppData directory and executed via rundll32, invoking an exported function named “jangadeiro” – a Portuguese term for the fisherman who pilots a jangada raft, consistent with the malware’s Brazilian origins.

The payload is approximately 750 MB in size, a figure the researchers attribute to junk padding rather than functional complexity. This is consistent with Lampion’s established anti-analysis approach and with independent reports of 700 MB-plus Lampion loaders. The chunked HTTP range-based downloading mechanism accommodates this file size.

The DLL functions as the RAT component, enabling remote access and data exfiltration.

Layered Evasion

A defining characteristic of the campaign is the use of obfuscation at every stage of the infection process. Oversized HTML and VBS files padded with junk code, encrypted URLs and dynamically generated scripts all serve to hinder static analysis and complicate detection.

The deliberate separation of execution into multiple independent stages further obscures the relationship between individual events, making the attack chain harder for security teams to reconstruct and monitor. Each stage operates independently enough that observing one component in isolation does not reveal the full scope of the attack.

Relevance Beyond Portugal

While the campaign concentrates on Portuguese victims, the evasion techniques used – layered obfuscation, multi-stage infection chains, junk code inflation, geofenced payload delivery and localised social engineering lures – are approaches that appear across threat campaigns in multiple regions.

For security teams in Australia and New Zealand, the campaign illustrates how threat actors are investing in anti-analysis techniques to defeat both static detection and behavioural analysis tools.

Detection And Hunting

TRU has published indicators of compromise including SHA-256 hashes for phishing emails, ZIP attachments, HTML files and VBS components, as well as domains and IP-based C2 hosts. The C2 hosts are described as ephemeral and may be reassigned to unrelated infrastructure.

Domains associated with the campaign include auto-contabilistica.com, autoridade-contabilistica.org, autoridade-financeira.com and fat-contabislitaca.com.

Defenders can hunt for several artefacts from this chain: rundll32.exe loading a DLL from a timestamp-named folder in AppData, particularly with a Portuguese-word export name; scheduled tasks running file move operations into AppData with a self-restart task set approximately five minutes out; VBScript in the temporary directory reassembling files via ADODB.Stream from range-based HTTP chunks; and unusually large DLLs written under AppData in timestamp-named folders.

The infection chain maps to multiple MITRE ATT&CK techniques including spearphishing attachment, user execution of malicious files, obfuscated files with binary padding, scheduled task persistence and system binary proxy execution via rundll32.

Last Updated on July 21, 2026 by Nick Ross