Loading story…
The Lampion banking malware operators have intensified phishing campaigns against Portuguese organizations, with activity heavily concentrated in Portugal and targeting sectors including government, finance, transportation, and private industry. Researchers said the infection chain uses ZIP attachments that lead victims to fake Portuguese-themed websites, including pages impersonating the country’s tax authority and other local organizations, to deliver social-engineering prompts that push users toward malware execution.
In observed attacks, victims were tricked with a ClickFix lure into launching a malicious PowerShell command, which then fetched multiple heavily obfuscated VBScript stages designed for persistence, reconnaissance, evasion, and command-and-control communication. The malware checks for security tools and sandbox or virtualized environments, exfiltrates a Base64-encoded victim identifier to cloud-hosted infrastructure, and prepares delivery of a large DLL-based remote-access payload associated with Lampion, although one observed chain stopped short of deploying the final payload because the download command was commented out.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Dark Reading reported Acronis researchers observed Lampion actively spreading in Portugal through phishing campaigns that use ZIP attachments, fake Portuguese-themed content, VBS scripts, and a DLL-based RAT payload. The activity was described as overwhelmingly concentrated in Portugal and included impersonation of private-sector Portuguese organizations.
Unit 42 said the Lampion banking malware operators have been active since at least 2019, establishing the long-running background for the campaign.
Unit 42 reported a highly targeted campaign against dozens of Portuguese organizations, especially in government, finance, and transportation, using phishing emails, fake Portuguese tax authority pages, and ClickFix social engineering. The observed chain delivered multiple obfuscated VBScript stages and infrastructure consistent with prior Lampion operations, though the final payload was not delivered in the captured activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 104 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
8 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcecyberveille.ch
Open sourcedarkreading.com
Open sourceacronis.com
Open sourceunit42.paloaltonetworks.com
Open sourceseguranca-informatica.pt
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported renewed activity from the **Lampion** banking trojan, a malware family that has targeted Portuguese internet users since 2019 through phishing messages impersonating tax and banking institutions. The latest observed variant, **release 212**, preserves Lampion’s established credential-theft workflow while introducing a more heavily obfuscated **VBS** loader padded with junk code and unusually large files to reduce antivirus detection. The infection chain uses an initial script to generate additional VBS files, establish persistence through a scheduled task and startup-folder artifacts, and retrieve two DLL stages from **AWS S3** buckets. The first DLL functions as a loader that extracts a password-protected second DLL containing the core Lampion payload, which retains export structures and decryption logic seen in earlier versions. Once active, the malware monitors running processes and browser page titles for hardcoded Portuguese and Brazilian banking targets, then displays overlay windows to steal credentials. Investigators also found that the campaign continued using the same command-and-control server, `5.188.9.28`, reportedly geolocated in Russia, linking the operation to infrastructure observed in campaigns dating back to 2020.
Aug 15, 2026
Attackers compromised financial regulator websites in Poland, Mexico, and Uruguay and used them as watering holes to target banks and other financial institutions with a selective, multi-stage malware campaign. In Poland, employees at several banks were infected after visiting the website of the Polish Financial Supervision Authority (**KNF**), where altered JavaScript loaded a hidden iframe and redirected chosen visitors to attacker-controlled infrastructure. Researchers said the operation used IP-based filtering and whitelisting to focus on roughly 150 targeted IP addresses across more than 100 organizations in 31 countries, with Poland and Mexico among the most heavily targeted. The delivery chain included malicious JavaScript, staged shellcode, and exploit content hosted on domains including `sap.misapor[.]ch` and `eye-watch[.]in`, with attackers serving Adobe Flash and Microsoft Silverlight exploits, including a repackaged exploit for `CVE-2016-0034`. The payloads included droppers, loaders, and remote-access trojans capable of process injection, encrypted command-and-control, service-based persistence, registry storage, timestamp tampering, and remote file and command execution. Banks reported malware on workstations and some servers, along with suspicious encrypted outbound traffic, though they said they had not identified unauthorized customer transactions. BAE Systems, Symantec, and ESET all found code, infrastructure, and tradecraft overlaps with malware previously associated with the **Lazarus Group**, including links to Downloader.Ratankba and Destover-related tooling, but some researchers stopped short of definitive attribution. Analysts also found transliterated Russian words embedded in malware and exploit components and assessed them as a likely false-flag attempt rather than genuine evidence of Russian operators.
Aug 15, 2026
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026