Lampion's Portugal-focused phishing campaign delivers multistage malware

As part of the Lampion malware campaign we’ve been tracking in recent weeks, we observed a wave of phishing emails designed to impersonate routine financial or administrative communications. The activity appears to be highly targeted and focuses overwhelmingly on victims in Portugal (94.6% of detections; see Statistics), leveraging Portuguese-language lures and local business impersonation to increase credibility.

Before examining each component in detail, the figure below provides a high-level overview of the infection chain observed in this campaign. The attack progresses through multiple staged components, beginning with a phishing email and culminating in the deployment of the Lampion RAT payload.

Below is an example message detected in June 2026, reflecting the most recent iteration of this activity:

This phishing email uses a simple financial pretext to encourage the recipient to open an attachment. It claims to include a “payment receipt,” which is a common social engineering tactic in malware campaigns: Presenting the attachment as an important transactional document to increase the likelihood of execution.

The message is also padded with credibility markers such as a confidentiality notice, an automated mailbox disclaimer and a full business signature with address and social media presence. These elements are typical in Lampion-related phishing lures, where attackers recycle professional-looking templates to blend into legitimate business communication.

The malicious attachment is delivered as a ZIP file named COMPROVATIVO-JUNHO_OJLWnObxFOyTZkx_01-06-2026_104.zip . Once extracted, it contains a relatively large web document (~1.3 MB), artificially inflated with nonsensical markup and randomized strings, likely intended to hinder analysis and evade detection.

When opened in a browser, it renders a convincing fake SAPO Transfer page. SAPO is a widely recognized Portuguese internet portal operated by Altice Portugal, offering services such as email, news and online tools, and its branding is abused here to increase trust and encourage user interaction with the malicious content. This abuse of SAPO branding is not new; SAPO impersonation has featured in prior Lampion campaigns.

In the background, the malicious JavaScript embedded within the rendered page initiates the retrieval of the -stage payload from an encrypted URL:

Upon decoding, the string 39103C3420686D562A36077B0D2C3A2D2C20281F3A3D3E340D04642A1A145C211A7D615775694A382C23 resolves to: hxxps://fat-contabislitaca[.]com/js/1898.php

Once the download is completed successfully, the retrieved JavaScript is dynamically injected into the already loaded document and executed. The script achieves this by creating a new element, assigning the downloaded content to its textContent property, and appending it to the page's section.

We assess with moderate confidence that the campaign's infrastructure employs strict geofencing and / or victim-tracking mechanisms, potentially restricting payload delivery. As a result, obtaining the -stage payload outside of a live infection chain is extremely challenging.

The second-stage VBS scripts follow the same naming convention as the ZIP archives and HTML lures used earlier in the infection chain, maintaining the appearance of legitimate financial or administrative documents. Examples observed during this campaign include:

Like the preceding stages, these scripts are heavily obfuscated. The sample analyzed for this report was approximately 7MB in size, despite containing only around 22KB of actual code. The remaining content consists primarily of junk variables, unnecessary functions, and encoded strings designed to inflate the file size, hinder static analysis, and evade signature-based detection. After deobfuscation, we determined that this stage performs two primary functions:

The final stage represents the most complex component of the infection chain, both in size and functionality. After removing extensive junk code and obfuscation layers, the core logic spans approximately 1,000 lines of code. At a high level, its behavior includes:

The primary objective of this stage is the retrieval and deployment of the final DLL payload into the %APPDATA% directory. For example: C:\Users\****\AppData\Roaming\20260304012702\20260304012702.dll

The downloaded DLL is executed via rundll32, invoking the exported function jangadeiro . The export name is itself a breadcrumb: Jangadeiro is Portuguese for the fisherman who pilots a jangada raft, a distinctly Brazilian term consistent with the malware's Brazilian origin. Telemetry indicates that the payload is unusually large (~750MB), a size we attribute to extensive junk padding rather than functional complexity — consistent with Lampion's established anti-analysis style and with independent reporting of 700MB+ Lampion loaders, which explains the use of chunked HTTP range-based downloading. The DLL functions as the main RAT component, enabling full remote access and data exfiltration capabilities.

The observed activity is overwhelmingly concentrated in Portugal, which accounts for 94.6% of all detections. This strong geographic skew indicates a highly targeted campaign, likely leveraging Portuguese-language lures to maximize credibility and engagement among victims in the region.

A small minority of activity was observed outside the primary target area, including Spain (4.3%) and the United Kingdom (1.1%). We assess these are likely incidental exposures or spillover outside the intended targeting scope, while the overall distribution strongly reinforces the assessment that the campaign is almost exclusively focused on Portugal.

The latest Lampion campaign demonstrates that the threat actor remains active and continues to refine its delivery techniques while maintaining a clear focus on Portuguese victims. By combining localized phishing lures and a multistage infection chain, the operators increase the likelihood of successful compromise while reducing the visibility of malicious activity.

A notable characteristic of this campaign is the extensive use of obfuscation across every stage of the infection process. From oversized HTML and VBS files padded with junk code to encrypted URLs and dynamically generated scripts, the threat actor employs multiple layers of evasion designed to hinder static analysis and complicate detection. The deliberate separation of execution into multiple independent stages further obscures the relationship between individual events, making the attack chain more difficult to reconstruct and monitor.

The observed infection chain maps to the following ATT&CK techniques:

Defenders can hunt for the following high-signal artifacts from this chain:

This threat is detected and blocked by Acronis EDR / XDR :

VBS final stage C2 hosts (defanged): (time-bound; validate before blocking. These IP-based hosts are ephemeral and may be reassigned to unrelated tenants.)