Threats Tagged 'lampion stealer'

The Lampion banking trojan campaign, active since at least 2019, is a sophisticated spam operation originating from Brazil that targets users primarily through malicious email attachments and ClickFix-themed lures. The infection chain uses multiple stages of obfuscated Visual Basic scripts to deploy an updated Lampion Stealer malware. The threat actors employ advanced evasion tactics such as IP blacklisting and large file sizes to hinder analysis, and they leverage multiple cloud providers for distributed, ephemeral infrastructure. The campaign targets domains mimicking Portuguese tax authorities and finance portals, indicating a focus on Portuguese-speaking European countries. Although no CVSS score is assigned, the threat poses a medium severity risk due to its potential to steal sensitive banking credentials and personal data, combined with its persistence and stealth. European organizations, especially in Portugal, are at heightened risk given the targeted domain names and lures. Defenders should focus on enhanced email filtering, user awareness training about attachments, domain monitoring, and endpoint detection of obfuscated script execution to mitigate this threat.

MediumMalwarePortugal#lampion#clickfix#banking trojan