Listen to this Post
Introduction – A Familiar Banking Threat Evolves Into a More Dangerous Campaign
Cybercriminals continue to refine their phishing operations, proving that even well-known malware families can become significantly more dangerous through new delivery techniques and improved evasion methods. One of the latest examples is the return of Lampion, a Brazilian banking malware family that has once again shifted its attention toward Portugal and Portuguese-speaking victims.
Unlike traditional malware campaigns that rely on small executable files or obvious malicious attachments, this latest operation abuses oversized HTML files, heavily obfuscated Visual Basic Scripts (VBS), Windows native utilities, and an unusually large Remote Access Trojan (RAT) approaching 750MB in size. The combination is designed not only to bypass security products but also to confuse malware analysts and delay incident response.
Security researchers from Acronis Threat Research Unit (TRU) discovered that nearly all observed infections were concentrated in Portugal, highlighting a highly targeted cyber campaign rather than a global opportunistic attack. The operation demonstrates how attackers increasingly combine social engineering with advanced evasion techniques to compromise victims without immediately raising suspicion.
Campaign Overview
Researchers have identified a sophisticated phishing campaign distributing the Lampion banking malware, targeting Portuguese-speaking users through convincing financial-themed emails.
The attackers disguise malicious messages as payment confirmations, invoices, administrative documents, and tax-related correspondence. Everything from corporate signatures to confidentiality notices is carefully replicated to convince recipients that the email originated from a legitimate business partner.
Rather than relying on traditional executable attachments, the campaign delivers oversized HTML documents hidden inside ZIP archives. These files serve as the first stage of a carefully orchestrated multi-step infection chain that ultimately installs a powerful Remote Access Trojan capable of compromising the victim’s computer.
Portugal Remains the Primary Target
One of the most striking findings from the investigation is the campaign’s geographical focus.
According to the researchers, approximately 94.6% of all detected attacks targeted users located in Portugal. Spain accounted for roughly 4.3%, while the United Kingdom represented only 1.1% of observed detections.
This distribution strongly suggests that Portugal is the attackers’ intended target rather than simply one country among many. Since Lampion first appeared in 2019, it has consistently abused Portuguese-language financial themes, demonstrating that the operators possess extensive knowledge of local businesses, banking practices, and user behavior.
Instead of casting a wide net, the criminals appear to favor precision attacks against organizations and individuals who are more likely to trust localized financial communications.
The Infection Begins With Convincing Phishing Emails
Like many successful cyberattacks, the infection starts with deception rather than exploitation.
Victims receive an email claiming to contain a payment receipt or financial confirmation document. Everything about the message is designed to appear authentic.
The emails include:
Confidentiality disclaimers
Professional company signatures
Corporate addresses
Automated mailbox notifications
Social media references
Administrative language
These details increase credibility and reduce suspicion, encouraging recipients to open the attached ZIP archive.
The attachment often carries names similar to:
COMPROVATIVO-JUNHO.zip
To most employees, the file appears indistinguishable from ordinary accounting documentation.
Oversized HTML Files Hide the First Stage
After opening the ZIP archive, victims discover an unusually large HTML document.
Instead of containing meaningful webpage content, the file is intentionally bloated to approximately 1.3MB through thousands of meaningless HTML elements, random text strings, and unnecessary markup.
This inflation serves several purposes.
First, it complicates static malware analysis.
Second, it interferes with signature-based antivirus engines.
Finally, it wastes
This technique represents a growing trend among modern malware developers who increasingly prioritize analysis resistance alongside traditional obfuscation.
Fake SAPO Transfer Page Tricks Victims
Once the HTML file is opened, the victim sees what appears to be a legitimate SAPO Transfer webpage.
SAPO is a widely recognized Portuguese online services platform, making it an ideal brand for attackers seeking user trust.
Behind the scenes, embedded JavaScript silently performs several malicious actions.
It decrypts a hidden remote server address, downloads an additional JavaScript payload, injects it into the currently opened browser page, and immediately executes the malicious script without requiring further user interaction.
To the victim, everything appears completely normal.
Meanwhile, the infection chain continues silently.
Geofencing Protects the Criminal Infrastructure
Researchers also discovered evidence that the attackers actively defend their infrastructure against investigation.
The malicious servers appear to employ geofencing techniques that selectively deliver payloads only to intended victims.
If researchers attempt to access the infrastructure from unrelated countries or suspicious environments, the servers may simply refuse to deliver the malware.
This tactic significantly reduces the likelihood of security researchers obtaining complete malware samples while simultaneously extending the campaign’s operational lifespan.
Selective payload delivery has become increasingly common among financially motivated cybercriminal groups.
Visual Basic Scripts Expand the Attack
The next stage downloads a heavily obfuscated Visual Basic Script.
One analyzed sample measured approximately 7MB, despite containing only around 22KB of actual executable code.
Everything else consisted of junk variables, meaningless routines, encoded strings, and unnecessary functions.
These additions serve no operational purpose other than frustrating analysts and defeating automated malware inspection tools.
Once cleaned and deobfuscated, researchers found that the script performs a much simpler task than its enormous size suggests.
Persistence Through Scheduled Tasks
The malicious VBS creates another downloader inside the Windows %TEMP% directory.
It then establishes persistence by creating a scheduled task capable of automatically retrieving and executing additional malware components.
Using scheduled tasks offers several advantages for attackers.
It avoids displaying suspicious application windows.
It blends into normal Windows administrative behavior.
It survives system reboots.
It allows later malware stages to execute automatically without additional user interaction.
This persistence mechanism enables attackers to maintain long-term access even if the initial phishing email is forgotten.
Windows rundll32.exe Launches a Massive Remote Access Trojan
Perhaps the most unusual aspect of this campaign is the final payload.
Rather than deploying a small banking Trojan, the attackers abuse Windows’ legitimate rundll32.exe utility to launch a Remote Access Trojan measuring approximately 750MB.
Using a trusted Windows component reduces suspicion because endpoint security products generally treat native operating system binaries differently than unknown executables.
Meanwhile, the enormous payload size can overwhelm certain analysis systems and complicate sandbox execution.
Once installed, the RAT provides attackers with remote access capabilities that extend far beyond credential theft, potentially enabling surveillance, file manipulation, credential harvesting, and additional malware deployment.
Why Lampion Continues to Succeed
Lampion’s success is not based on exploiting unknown software vulnerabilities.
Instead, it exploits human psychology.
Employees regularly receive invoices.
Businesses exchange payment confirmations every day.
Accounting departments process receipts continuously.
Attackers understand these routines and carefully imitate them.
Rather than breaking security technology directly, they persuade users to voluntarily initiate the infection themselves.
This remains one of the most effective techniques in modern cybercrime.
Deep Analysis
The Lampion campaign illustrates a broader evolution in phishing operations where attackers increasingly combine oversized files, layered obfuscation, trusted Windows utilities, and infrastructure protections to evade both automated defenses and manual analysis. Instead of relying on zero-day exploits, the operators weaponize legitimate administrative workflows and native Windows features.
From a defensive perspective, organizations should monitor suspicious executions involving HTML Application behavior, Visual Basic Scripts, scheduled task creation, and unexpected use of rundll32.exe launching non-standard DLLs. Security teams should also inspect large HTML attachments and ZIP archives that appear unusually inflated.
Useful Windows Investigation Commands
schtasks /query /fo LIST /v
Get-ScheduledTask
dir %TEMP%
tasklist
netstat -ano
wmic process list full
Get-Process
Get-FileHash suspicious_file.vbs -Algorithm SHA256
Get-ChildItem $env:TEMP -Recurse
wevtutil qe Security /f:text /c:50
Threat Hunting Examples
Get-WinEvent -LogName Security
Get-ScheduledTask | Where-Object {$_.TaskName -like ""}
Get-ChildItem C:\Users\AppData\Local\Temp -Recurse
Get-Process rundll32
Get-NetTCPConnection
SOC Investigation Priorities
Identify suspicious scheduled tasks.
Review execution of HTML and VBS files.
Examine abnormal rundll32.exe activity.
Monitor outbound connections to newly observed domains.
Inspect large HTML attachments bypassing email filters.
Verify endpoint persistence mechanisms.
Hunt for credential theft indicators.
Correlate phishing emails with endpoint telemetry.
Review PowerShell and Windows Event Logs.
Block malicious hashes and infrastructure across SIEM and EDR platforms.
What Undercode Say:
Lampion demonstrates that
The use of nearly 750MB malware is another strategic decision. Large payloads can exceed scanning thresholds, consume sandbox resources, and delay uploads to cloud-based analysis services. While file size alone is not a reliable indicator of maliciousness, combining abnormal size with obfuscation significantly increases analysis complexity.
Another notable characteristic is the
Geofencing further reveals operational maturity. Criminal groups increasingly understand how security vendors collect samples, so restricting payload delivery helps preserve infrastructure and reduces exposure.
The abuse of trusted Windows components like rundll32.exe also reflects a long-standing attacker strategy known as “living off the land.” By leveraging legitimate system binaries, adversaries reduce behavioral anomalies that many security products monitor.
Defenders should therefore emphasize behavioral detection rather than simple signature matching. Monitoring suspicious process chains, scheduled task creation, script execution, and unusual network communications will often reveal attacks that traditional antivirus solutions miss.
Organizations should also strengthen phishing awareness programs, especially for finance departments that routinely process invoices and payment confirmations. Since Lampion relies heavily on social engineering rather than software exploits, user education remains one of the most effective preventive controls.
Email gateways should inspect oversized HTML files and compressed archives more aggressively. Files that contain excessive junk content without a legitimate business purpose deserve additional scrutiny.
Security teams should regularly audit scheduled tasks, temporary directories, and Windows script execution logs, as these remain common persistence points for multi-stage malware campaigns.
Ultimately, Lampion serves as a reminder that modern malware campaigns are becoming more sophisticated in delivery, evasion, and persistence. Attackers no longer depend solely on advanced exploits—they increasingly weaponize trust, routine business processes, and legitimate operating system features to achieve their objectives.
✅ Fact: Lampion is a Brazilian banking malware family first documented in 2019 and has repeatedly targeted Portuguese-speaking victims. This aligns with long-term threat intelligence observations.
✅ Fact: The campaign heavily relies on phishing emails, oversized HTML files, obfuscated VBS scripts, scheduled tasks, and Windows rundll32.exe to deliver later malware stages. These techniques are consistent with the researchers’ findings.
✅ Fact: Portugal represents the overwhelming majority of observed detections, indicating a highly localized campaign rather than indiscriminate global malware distribution. The geographical concentration supports the assessment that Portuguese organizations remain the primary target.
Prediction
(-1) Cybercriminal groups will increasingly adopt oversized and highly obfuscated payloads to overwhelm automated analysis systems, making traditional signature-based defenses less effective.
(+1) Security vendors will expand behavioral detection capabilities focused on script execution, scheduled task creation, and abuse of legitimate Windows utilities, significantly improving early detection of campaigns similar to Lampion.
(-1) Financial departments and Portuguese-speaking organizations are likely to remain attractive targets because localized phishing consistently delivers higher success rates than generic global spam campaigns.
▶️ Related Video (80% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.quora.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
