Loading story…
Researchers reported renewed activity from the Lampion banking trojan, a malware family that has targeted Portuguese internet users since 2019 through phishing messages impersonating tax and banking institutions. The latest observed variant, release 212, preserves Lampion’s established credential-theft workflow while introducing a more heavily obfuscated VBS loader padded with junk code and unusually large files to reduce antivirus detection. The infection chain uses an initial script to generate additional VBS files, establish persistence through a scheduled task and startup-folder artifacts, and retrieve two DLL stages from AWS S3 buckets.
The first DLL functions as a loader that extracts a password-protected second DLL containing the core Lampion payload, which retains export structures and decryption logic seen in earlier versions. Once active, the malware monitors running processes and browser page titles for hardcoded Portuguese and Brazilian banking targets, then displays overlay windows to steal credentials. Investigators also found that the campaign continued using the same command-and-control server, 5.188.9.28, reportedly geolocated in Russia, linking the operation to infrastructure observed in campaigns dating back to 2020.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
A Lampion phishing campaign used a WeTransfer link masquerading as a proof-of-payment document to deliver a ZIP archive containing a malicious VBS loader. The infection chain downloaded final DLL payloads from external URLs including Amazon S3, representing a newly observed delivery variation for Lampion.
Lampion release 212 was active in February 2022, continuing the malware family's established banking-theft activity while using a modified VBS loader padded with junk data to evade detection.
The report states Lampion had been using the same command-and-control server, 5.188.9.28, since at least 2020. Researchers also noted the server was geolocated in Russia.
Lampion was reported to have impacted Portuguese internet end users since 2019, using phishing lures impersonating Portuguese tax and banking institutions to deliver its malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cofense.com
Open sourcesecurityaffairs.co
Open sourceseguranca-informatica.pt
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Lampion** banking malware operators have intensified phishing campaigns against Portuguese organizations, with activity heavily concentrated in Portugal and targeting sectors including government, finance, transportation, and private industry. Researchers said the infection chain uses ZIP attachments that lead victims to fake Portuguese-themed websites, including pages impersonating the country’s tax authority and other local organizations, to deliver social-engineering prompts that push users toward malware execution. In observed attacks, victims were tricked with a **ClickFix** lure into launching a malicious PowerShell command, which then fetched multiple heavily obfuscated VBScript stages designed for persistence, reconnaissance, evasion, and command-and-control communication. The malware checks for security tools and sandbox or virtualized environments, exfiltrates a Base64-encoded victim identifier to cloud-hosted infrastructure, and prepares delivery of a large DLL-based remote-access payload associated with Lampion, although one observed chain stopped short of deploying the final payload because the download command was commented out.
Jul 24, 2026
The **Grandoreiro** banking trojan has re-emerged in campaigns targeting Portuguese banks and organizations across Spain, Mexico, and Latin America, showing that the malware remains active despite earlier law-enforcement disruption. Researchers reported phishing-led delivery chains using ZIP archives, loaders disguised as PDFs, **DLL side-loading**, and malicious **VBS** scripts hosted through abused legitimate services. In earlier observed activity, the operators impersonated government entities such as the Attorney General's Office of Mexico City and Spain's Public Ministry to lure employees at manufacturing, automotive, machinery, and chemicals companies into opening malicious attachments. The latest variants use stronger evasion and persistence techniques, including binary padding to roughly **400MB**, CAPTCHA-based execution, Windows Registry persistence, geofencing, and anti-analysis checks. Once installed, Grandoreiro can steal credentials, log keystrokes, monitor the clipboard, enumerate antivirus products, cryptocurrency wallets, and e-banking applications, and display fake banking overlays, while blending command-and-control traffic through trusted cloud services including **Google Cloud**, **Microsoft Azure**, and **Amazon**. Brazilian police previously arrested suspects tied to Grandoreiro operations, but the renewed campaigns indicate the financially motivated group continues to operate across multiple countries.
Jun 29, 2026
Researchers tied the **DELoader** malware family targeting German-speaking users to the later **Zloader**/**Zeus Sphinx** banking trojan, showing how an early loader evolved into a broader modular crimeware platform. Fortinet found DELoader creating a suspended `explorer.exe`, decrypting and injecting an embedded DLL, then downloading and validating an additional PE payload from command-and-control infrastructure. Exposed victim logs and code strings indicated infections concentrated in **Germany and Austria**, while domain registration details overlapped with infrastructure previously associated with **Zeus** and **Marcher** banking malware campaigns. Later reverse engineering showed Zloader using layered obfuscation, process injection, encrypted configuration data, and a **domain generation algorithm (DGA)** that produces 20-character `.com` fallback domains from date-based seeds and embedded RC4 keys. Avast described **Zloader 2 / Silent Night** as a modular banking malware platform capable of credential theft, web injects, keylogging, screenshot capture, VNC-style remote control, cryptocurrency wallet theft, and delivery of additional payloads, with distribution through spam, fake installers, and malicious websites. Investigators also linked Zloader operations to other malware ecosystems including **Raccoon Stealer** and **Ursnif**, and noted that its botnet infrastructure became the subject of a joint **Microsoft-led takedown** effort.
Aug 15, 2026