Acronis Threat Research Unit (TRU) has identified a new campaign that exploits false financial communications, advanced obfuscation techniques and an infrastructure designed to evade security systems. 94.6% of the attacks are concentrated in Portugal
Acronis, global leader in the protection informatica, announces that it has identified a new active campaign of the Lampion malware, a family of banking Trojans of Brazilian origin that continues to almost exclusively target Portuguese users. According to analysis by the Acronis Threat Research Unit (TRU), the threat spreads through phishing emails that imitate legitimate financial or administrative communications and leverages a complex, multi-stage infection chain designed to evade detection.
Lampion has been documented for the first appeared in 2019 as an evolution of the ChePro malware. Despite being born in Brazil, over time it has concentrated its activities mainly against Portuguese-speaking users, with attention to Portugal. Telemetry data collected by Acronis confirms the trend: the 94.6% of detections concerns Portuguese territory, while only a marginal share concerns Spain (4.3%) and the United Kingdom (1.1%), probably as a side effect of the spread of malware.
A fake payment receipt as bait
The attack begins with an email message inviting the recipient to open a supposed payment receipt. This is a classic social engineering technique, enriched with elements that increase the credibility of the communication: complete company signatures, confidentiality notes, automatic disclaimers and references to social media.
The attachment is a ZIP archive containing a large HTML file, artificially bloated with useless code and random strings. The goal is twofold: to make analysis more difficult for researchers and to reduce the effectiveness of automatic detection systems. Once opened in the browser, the document displays a fake page of the SAPO Transfer service, a well-known platform in Portugal. The improper use of the SAPO brand represents a recurring element in Lampion campaigns, exploited to increase the level of trust of the victim and encourage interaction with the malicious content. Meanwhile, in the background, the embedded JavaScript code automatically downloads and executes scripts for the next stage of the attack from servers controlled by the attackers.
An infection chain built to escape control
One of the most sophisticated aspects of the campaign is the multi-level structure of the infection. Each phase performs a specific function and prepares the next one, limiting the overall visibility of the attack.
Acronis also believes, with a moderate confidence level, that operators use geofencing techniques and victim tracking systems to limit malware distribution to only the intended targets. This makes it particularly difficult to recover complete payloads outside of an actual infection chain.
The second phase introduces heavily obfuscated Visual Basic (VBS) scripts. Although the actual executable code is a few tens of kilobytes, each file reaches a size of about 7 MB thanks to the insertion of large amounts of useless data, dummy variables and superfluous functions. After deobfuscation, the researchers verified that these scripts prepare the next payload for download and configure scheduled Windows tasks to ensure they run automatically.
The final phase is also the most complex. The final script verifies that only one instance of the malware is running, deletes any temporary files used in the previous steps and creates a unique identifier of the victim based on the hardware and software characteristics of the system.
It then establishes communication with the command and control server (C2), sends information about the compromised device, checks for previous installations and downloads the final payload.
The latter is saved in the AppData folder and executed via rundll32. The DLL contains the real RAT (Remote Access Trojan) component, which allows attackers to gain remote control of the infected system and exfiltrate sensitive data. An unusual element observed by the researchers concerns the size of the payload, which reaches approximately 750 MB. According to Acronis, this value does not reflect greater complexity of the malware, but rather a massive presence of useless data deliberately inserted to hinder analysis and security systems. For this reason the file is downloaded in blocks using HTTP Range requests, a technique consistent with previous variations of Lampion.
Increasingly sophisticated obfuscation
The analysis highlights how obfuscation today represents one of the distinctive elements of the Lampion family. HTML, JavaScript, and VBS scripts are deliberately burdened with junk code, encrypted strings, and dynamically generated components, making both static analysis and detection using traditional signatures much more difficult. The fragmentation of the attack into several independent phases constitutes a further level of evasion: each component performs a limited task and passes control to the next one, reducing the possibility of reconstructing the entire chain of compromise.
A threat that is still highly specialized
For Acronis, this new campaign confirms that Lampion operators are still fully active and continue to refine their attack techniques. The use of Portuguese-language decoys, the impersonation of popular services such as SAPO, and a sophisticated multi-stage architecture help increase the probability of success while simultaneously limiting the detection ability of security solutions. The strong geographical concentration of the detections also confirms the highly targeted nature of the campaign, which continues to target Portuguese users almost exclusively, demonstrating how cybercriminals are increasingly focusing on specialized operations, adapted to the linguistic and territorial context of their victims.
