Lampion malware campaign targets users in Portugal

Acronis has identified an active Lampion malware campaign targeting users in Portugal, highlighting the growing use of layered evasion techniques in phishing attacks.

The campaign uses phishing emails disguised as financial and administrative messages to persuade recipients to open attached files. Researchers found that 94.6% of detections were in Portugal, with smaller volumes in Spain and the United Kingdom.

Lampion is a Brazilian banking malware family first publicly documented in 2019. Acronis said it has consistently focused on Portugal and other Portuguese-speaking users rather than victims in Brazil.

The attack chain begins with a phishing email carrying a ZIP archive. When opened, the archive contains an HTML file padded with random content and extra code to increase its size and make static analysis more difficult.

When opened in a browser, the file displays a fake SAPO Transfer page that imitates a well-known Portuguese internet brand. In the background, embedded JavaScript retrieves another payload from attacker-controlled infrastructure and injects it into the document for execution.

Researchers said the campaign appears to use geofencing or victim-tracking controls to limit payload delivery outside a live infection chain. That has made it harder to obtain later-stage samples independently.

Multi-stage chain

The second stage relies on VBS scripts that continue the naming pattern of the earlier files, preserving the appearance of ordinary financial paperwork. A sample analysed by Acronis was about 7 MB in size, although only around 22 KB was working code.

The rest of the file consisted largely of junk variables, unnecessary functions and encoded strings. After deobfuscation, researchers found that the script creates another downloader in the temporary directory and sets up a scheduled task to fetch and run the next stage.

The final VBS stage is the most complex part of the chain. It checks whether the system is already infected, communicates with command-and-control infrastructure, downloads the main payload in 10 MB chunks and establishes persistence through the Windows Task Scheduler.

The final payload is a DLL stored under the roaming application data directory in a timestamp-named folder. It is then launched with rundll32 using an exported function named jangadeiro, a Portuguese word that researchers said is consistent with the malware's Brazilian origin.

The DLL serves as the main remote access trojan, giving attackers access to infected systems and the ability to remove data. Telemetry showed the payload was unusually large at roughly 750 MB, which Acronis attributed to junk padding rather than functional complexity.

Evasion methods

The study highlights how attackers are spreading activity across several stages to reduce visibility for defenders. By fragmenting execution across HTML, JavaScript and VBS components, the operators make it harder for analysts and detection tools to reconstruct the full chain.

The campaign also uses encrypted URLs, dynamically generated scripts and oversized files stuffed with irrelevant code. Acronis said those methods are intended to frustrate both signature-based detection and manual analysis.

Among the more distinctive traits were VBS scripts in the temporary directory that remove other VBS files, scheduled tasks that move downloaded files into application data folders, and the use of HTTP range requests to download large payloads in sections. Researchers also pointed to rundll32 loading a DLL from a timestamp-based path as a useful signal for defenders.

The infrastructure linked to the campaign included domains masquerading as accounting or financial services. Acronis also listed a series of command-and-control hosts it described as time-bound and potentially reassigned, indicating the actors are using infrastructure that may be short-lived.

The findings reflect a broader shift in cybercrime operations towards stealthier delivery methods. Rather than relying on a single malicious attachment or obvious executable, attackers are chaining together multiple script-based steps that each reveal only part of the activity.

That approach can increase the burden on security teams, particularly where monitoring tools focus on individual files rather than related behaviour across endpoints. The concentration of detections in Portugal suggests a narrowly defined campaign, but the techniques described are not unique to one geography.

The report said the operation overwhelmingly targeted Portuguese users through local-language lures and impersonation of familiar organisations, while the small share of detections outside Portugal was likely spillover beyond the intended target base.

Acronis mapped the campaign to a range of common attack techniques, including spearphishing attachments, malicious file execution, obfuscated files, scheduled tasks, web-based command traffic and the use of rundll32 as a proxy for execution.

The latest activity suggests Lampion's operators remain active and continue to refine their delivery methods while keeping a tight focus on Portuguese victims.