Threats Tagged 'lampion'

An active Lampion malware campaign has been identified targeting Portuguese users through phishing emails that impersonate financial and administrative communications. Lampion, a Brazilian banking malware derived from the ChePro lineage, delivers initial payloads via ZIP archives containing heavily obfuscated HTML files designed to evade detection. The HTML stage retrieves additional scripts from attacker-controlled infrastructure, initiating a multistage VBS infection chain. Each stage employs extensive obfuscation techniques including junk code, encrypted strings, and dynamically generated scripts that inflate file sizes while concealing core functionality. The infection chain is deliberately fragmented across multiple independent execution stages, complicating behavioral analysis. Telemetry shows 94.6% of detections concentrated in Portugal, confirming this is a highly targeted threat focused on Portuguese-speaking victims.

MediumMalwarePortugal#phishing campaign#banking trojan#vbs infection chain

The Lampion banking trojan campaign, active since at least 2019, is a sophisticated spam operation originating from Brazil that targets users primarily through malicious email attachments and ClickFix-themed lures. The infection chain uses multiple stages of obfuscated Visual Basic scripts to deploy an updated Lampion Stealer malware. The threat actors employ advanced evasion tactics such as IP blacklisting and large file sizes to hinder analysis, and they leverage multiple cloud providers for distributed, ephemeral infrastructure. The campaign targets domains mimicking Portuguese tax authorities and finance portals, indicating a focus on Portuguese-speaking European countries. Although no CVSS score is assigned, the threat poses a medium severity risk due to its potential to steal sensitive banking credentials and personal data, combined with its persistence and stealth. European organizations, especially in Portugal, are at heightened risk given the targeted domain names and lures. Defenders should focus on enhanced email filtering, user awareness training about attachments, domain monitoring, and endpoint detection of obfuscated script execution to mitigate this threat.

MediumMalwarePortugal#lampion#clickfix#banking trojan

The ClickFix social engineering technique has gained popularity among threat actors, targeting thousands of devices globally. It tricks users into executing malicious commands on their devices by exploiting their tendency to solve minor technical issues. The technique often impersonates legitimate brands and combines with delivery vectors like phishing and malvertising. ClickFix campaigns typically lead users to a visual lure, such as a landing page, instructing them to run commands in the Windows Run dialog. This user interaction element helps bypass conventional security solutions. Various malware, including infostealers and remote access tools, are delivered through ClickFix attacks. The technique has evolved to target macOS users and is being sold as part of malware kits on hacker forums.

MediumMalwareFranceGermanyHungary+3#social engineering#remote access tool#malvertising

A highly focused malicious campaign targeting Portuguese organizations, particularly in government, finance, and transportation sectors, has been uncovered. The campaign is linked to Lampion malware, an infostealer focusing on banking information. The threat actors have incorporated ClickFix lures, a social engineering technique that tricks victims into executing malicious commands. The infection chain involves multiple stages of obfuscated Visual Basic scripts, evasion techniques, and a complex execution method. While the final payload was not delivered in this instance, the campaign demonstrates the threat actors' adaptation and sophistication. The article emphasizes the importance of enhanced detection capabilities and provides recommendations for security practitioners to address this evolving threat.

MediumMalwarePortugalSpainFrance+2#clickfix#infostealer#lampion