Listen to this Post
Introduction, An Old Malware That Refuses to Disappear
Cybersecurity is often portrayed as a race between defenders and attackers, with both sides constantly adopting new technologies. However, not every successful cyberattack relies on cutting-edge malware or artificial intelligence. Sometimes, old malicious tools continue to succeed simply because organizations continue making the same mistakes.
One of the clearest examples is Lampion, a Brazilian banking Trojan first discovered in 2019. Despite being several years old, it remains highly active in 2026, targeting Portuguese organizations through carefully crafted phishing campaigns. Rather than reinventing itself, Lampion continues to exploit human trust, weak email security, and familiar administrative processes.
The latest research from Acronis demonstrates that this long-lived malware family has barely changed technically, yet it continues to compromise victims throughout Portugal. The campaign highlights an uncomfortable reality for cybersecurity professionals: effective cybercrime often depends more on social engineering than technical innovation.
A Banking Trojan That Has Survived for Years
Lampion first appeared during the holiday season of 2019 and quickly became associated with Brazil’s thriving cybercrime ecosystem. While many malware families disappear after security vendors detect them, Lampion has remained surprisingly resilient.
Unlike ransomware groups that constantly rebrand and redesign their infrastructure, Lampion’s operators have made only incremental improvements over the years. Their philosophy appears simple.
If the malware continues making money, why change it?
Researchers believe this practical approach explains why Lampion remains operational seven years after its initial discovery.
Portugal Remains the Primary Target
One of
Instead of launching worldwide attacks, the operators concentrate almost exclusively on Portuguese organizations.
Recent telemetry indicates that approximately 96.4% of observed attacks have targeted Portugal, while only a very small number reached Spain and England.
This geographic precision strongly suggests the attackers use geofencing techniques to prevent unnecessary exposure and maintain operational efficiency.
Rather than infecting random victims globally, they deliberately pursue organizations where success rates are highest.
Why Portuguese Organizations Are Attractive Targets
The answer lies in language.
Brazil and Portugal share Portuguese as their native language. This allows Brazilian cybercriminals to create phishing emails that appear completely natural to Portuguese recipients.
Unlike attacks translated by automated software, Lampion emails contain culturally accurate wording, local financial terminology, authentic formatting, and convincing administrative language.
As a result, victims rarely suspect they are interacting with foreign attackers.
Language becomes one of the
Phishing Emails Continue to Drive Infections
Lampion has always relied heavily on phishing campaigns.
Historically, attackers impersonated
The newest campaign demonstrates an evolution in social engineering rather than malware development.
Instead of government agencies, attackers now imitate private businesses.
One observed campaign impersonated an automotive documentation agency, sending fraudulent electronic receipts for transactions that never existed.
These emails include:
Authentic Branding
Official logos.
Corporate formatting.
Professional email signatures.
Confidentiality disclaimers.
Even legitimate-looking social media references.
To an unsuspecting employee, everything appears genuine.
The Infection Chain Begins with a ZIP Archive
Victims who believe the phishing email download a compressed ZIP archive.
Once extracted, the infection process begins automatically.
Rather than immediately installing malware, Lampion first displays a webpage closely resembling Portugal’s popular SAPO internet portal.
This visual distraction keeps users occupied while malicious scripts quietly execute behind the scenes.
The victim believes a document is loading.
Meanwhile, malware installation has already begun.
VBS Scripts Prepare the System
Lampion relies heavily on Visual Basic Scripts (VBS).
These scripts perform multiple functions before the primary malware activates.
Typical actions include:
Creating scheduled tasks
Establishing persistence
Contacting command-and-control servers
Preparing the operating environment
Downloading additional malware components
These early stages ensure the malware survives system reboots and remains connected to attacker infrastructure.
Heavy Obfuscation Remains a Signature Feature
One of
Almost every stage of execution contains intentionally confusing code designed to frustrate malware analysis.
Although modern security solutions detect many obfuscation methods, these techniques continue defeating weaker antivirus products and slowing manual investigation.
Researchers note that Lampion frequently hides malicious logic beneath multiple scripting layers.
The Final Payload Is a Remote Access Trojan
The final malware component arrives as a DLL.
This Dynamic Link Library serves as the
Once installed, it provides attackers with significant control over compromised systems.
Capabilities reportedly include:
Banking Credential Theft
The malware injects fake overlays into legitimate Portuguese banking websites.
Victims unknowingly enter usernames, passwords, and authentication information directly into attacker-controlled forms.
System Reconnaissance
Lampion also gathers valuable intelligence, including:
Operating system details
Browser information
Hardware characteristics
Installed software
User activity
This information helps attackers customize future attacks or sell victim profiles on underground markets.
Old Techniques Still Produce Results
According to Acronis researcher Jozsef Gegeny, attackers have little motivation to redesign Lampion because its existing methods continue generating profits.
This reflects an important cybersecurity lesson.
Innovation is not always necessary.
Cybercriminals often prioritize reliability over sophistication.
As long as phishing campaigns continue fooling users, there is little reason to invest significant resources developing entirely new malware.
Brazil’s Expanding Cybercrime Ecosystem
Brazil has become one of the
Many criminal groups operate structured organizations with developers, infrastructure managers, phishing specialists, and money laundering networks.
These groups increasingly target international victims rather than domestic organizations.
The reasons are strategic.
International investigations require cooperation between multiple governments.
Cross-border investigations move slower.
Legal jurisdiction becomes more complicated.
This additional complexity benefits attackers.
Language Gives Criminals a Competitive Advantage
Threat intelligence researchers explain that Brazilian cybercriminals generally begin by targeting countries sharing Portuguese.
Portugal naturally becomes the first choice.
Afterward, many campaigns expand toward Spanish-speaking regions.
The shared language dramatically improves phishing success rates.
Employees recognize familiar expressions, legal terminology, and financial language.
This psychological familiarity lowers suspicion.
Cyber Risk Has Become
The growing volume of cyberattacks is changing how Portuguese businesses view operational risk.
According to Marsh
This marks the first time in the
The shift reflects increasing awareness that cyber incidents can halt operations, damage reputations, and produce severe financial losses.
Deep Analysis
Lampion’s attack chain aligns with several MITRE ATT&CK techniques commonly observed in financially motivated malware campaigns.
Example Indicators
schtasks /query
Checks for suspicious scheduled tasks created by malware.
Get-ScheduledTask
Lists scheduled tasks for persistence analysis.
tasklist
Identifies suspicious running processes.
Get-Process
Displays active processes for forensic review.
netstat -ano
Detects unexpected outbound command-and-control connections.
Get-NetTCPConnection
Monitors active TCP sessions.
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Searches for persistence mechanisms.
Get-FileHash suspicious.dll -Algorithm SHA256
Verifies malware hashes during incident response.
Get-WinEvent -LogName Security
Reviews Windows security logs for suspicious activity.
Relevant MITRE ATT&CK Techniques
T1566.001, Phishing Attachment
T1204, User Execution
T1053.005, Scheduled Task
T1027, Obfuscated Files
T1105, Ingress Tool Transfer
T1071, Application Layer Protocol
T1082, System Information Discovery
T1055, Process Injection
T1113, Screen Capture (possible)
T1005, Data Collection
Organizations should combine email filtering, endpoint detection, behavioral monitoring, multi-factor authentication, and continuous phishing awareness training to reduce exposure against campaigns like Lampion.
What Undercode Say
Lampion is a perfect example of why cybersecurity is fundamentally a people problem before it becomes a technology problem. Many organizations spend millions deploying AI-powered security tools while attackers continue succeeding with phishing emails and scripts that are years old.
The malware itself is not particularly revolutionary. Its persistence comes from operational discipline rather than technical brilliance. The attackers understand their victims, speak their language, and imitate trusted institutions with remarkable accuracy. That combination consistently defeats human judgment.
Another important observation is the regional specialization of modern cybercrime. Rather than attacking the entire internet indiscriminately, threat actors increasingly focus on markets where language, culture, and administrative familiarity provide higher success rates. Portugal illustrates how shared language can become an unexpected cybersecurity liability.
The campaign also demonstrates the effectiveness of incremental evolution. Lampion has not required major redesigns because defenders have not eliminated the weaknesses it exploits. As long as employees continue opening convincing phishing emails and organizations fail to enforce strong attachment controls, the malware remains profitable.
The use of ZIP archives, VBS scripts, scheduled tasks, and DLL-based payloads may appear outdated, but these techniques remain compatible with many enterprise environments. Attackers deliberately favor methods that are stable, reliable, and easy to maintain over flashy innovations that may trigger advanced security controls.
Geofencing is another strategic decision worth noting. By restricting infections primarily to Portugal, operators reduce unnecessary exposure and minimize the chances of widespread detection by global researchers. Smaller, targeted campaigns often survive much longer than indiscriminate attacks.
Cross-border law enforcement continues to present challenges. Criminal groups operating in one country while targeting another benefit from jurisdictional complexity, slower legal cooperation, and varying investigative priorities. International coordination remains essential to dismantling these operations.
For defenders, the lesson is clear. Modern cybersecurity cannot rely solely on signature-based detection. Organizations need layered defenses, behavioral monitoring, continuous threat hunting, robust email security, rapid incident response capabilities, and regular employee awareness training.
Lampion also reinforces that age is not a reliable indicator of danger. Legacy malware can remain highly effective when paired with convincing social engineering. Security teams should focus on attack techniques and adversary behavior rather than assuming older malware families are no longer relevant.
Finally,
Prediction
(+1) Defensive Technologies Will Become More Behavior-Oriented
Over the next few years, security vendors are likely to invest even more heavily in behavioral analytics, identity protection, and AI-assisted phishing detection rather than relying primarily on malware signatures. Organizations adopting layered security architectures, continuous user education, and Zero Trust principles will significantly reduce the effectiveness of long-standing threats like Lampion. At the same time, financial institutions are expected to strengthen fraud detection systems capable of identifying suspicious banking sessions before stolen credentials can be abused.
✅ Fact: Lampion is a Brazilian banking Trojan first identified in 2019 and continues to target Portuguese organizations through phishing campaigns. This is consistent with current threat intelligence research.
✅ Fact: The malware primarily spreads through phishing emails, ZIP archives, VBS scripts, and DLL payloads while stealing banking credentials using browser overlays and remote access techniques. These behaviors have been repeatedly documented.
✅ Fact: Portuguese organizations remain the primary victims because of the shared Portuguese language and attackers’ preference for cross-border operations, making international law enforcement more challenging and increasing the campaign’s longevity.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.darkreading.com
Extra Source Hub (Possible Sources for article):
https://www.linkedin.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
