This threat involves an active Lampion malware campaign targeting Portuguese users through phishing emails that mimic legitimate financial and administrative communications. Lampion, a Brazilian banking malware derived from the ChePro lineage, uses ZIP archives with heavily obfuscated HTML files as initial payloads. These HTML files retrieve additional scripts from attacker-controlled infrastructure, triggering a multistage VBS infection chain. Each stage employs extensive obfuscation techniques such as junk code, encrypted strings, and dynamically generated scripts to conceal core functionality and inflate file sizes. The infection chain is deliberately fragmented across multiple independent execution stages, complicating behavioral analysis and detection. Telemetry data indicates a strong geographic focus on Portugal, with 94.6% of detections occurring there, confirming the campaign's targeting of Portuguese-speaking victims.

The campaign delivers banking malware capable of compromising financial information of targeted Portuguese users. The multistage infection chain and heavy obfuscation techniques increase the difficulty of detection and analysis, potentially allowing the malware to persist and exfiltrate sensitive data. The phishing emails impersonate trusted financial and administrative entities, increasing the likelihood of user interaction and successful infection.

No official patch or fix is available as this is a malware campaign rather than a software vulnerability. Mitigation focuses on user awareness to recognize phishing emails impersonating financial and administrative entities, blocking and monitoring the identified malicious domains and URLs, and employing advanced endpoint detection solutions capable of identifying obfuscated scripts and multistage infection behaviors. Organizations should update their email filtering and anti-malware defenses to detect the indicators of compromise provided. Since this is not a cloud service, remediation depends on local defenses and user education.