Lampion
Lampion is a banking trojan and infostealer focused on sensitive banking information. The content states it has been active since at least 2019 and has been heavily associated with Portuguese-language and Portuguese-targeted campaigns, including activity against organizations in government, finance, and transportation. It has also been described as known to target Latin American users, and Cofense notes Lampion Banking Trojan was almost exclusively observed in Portuguese-language campaigns.
Observed delivery vectors include phishing emails with ZIP attachments, HTML files inside archives, SEO poisoning, compromised websites, and ClickFix-style social engineering. In the documented 2025 campaigns, victims were redirected to fake Portuguese tax authority-themed pages and tricked into copying and executing malicious PowerShell commands via the Windows Run dialog under the guise of fixing a problem or enabling file preview.
The infection chain described by Microsoft and Unit 42 is multi-stage and heavily obfuscated. PowerShell downloads obfuscated VBScript/VBS stages; execution is split across non-consecutive processes and hidden scheduled tasks to hinder detection and process-tree correlation. Later stages perform reconnaissance and evasion, including WMI checks for security products and sandbox/VM detection, gather endpoint data, generate a victim identifier, communicate with cloud-hosted C2 infrastructure, and use rundll32.exe to launch a large DLL loader. Unit 42 reported stage-3 scripts of roughly 30-50 MB with junk code and a stage-4 DLL loader exceeding 700 MB. In the observed campaign, the final Lampion payload was not actually delivered because the payload download command was commented out.
Unit 42 attributed a focused campaign against dozens of Portuguese organizations to Lampion operators based on shared infrastructure, including reuse of a C2 server used in prior Lampion infections. Microsoft reported the campaign was active in May-June 2025 and later expanded beyond Portugal to organizations in Switzerland, Luxembourg, France, Hungary, and Mexico across government, education, transportation, and financial services sectors.
High-confidence infrastructure and IOC details mentioned in the content include domains autoridade-tributaria[.]com and inde-faturas[.]com, C2 IPs 5.8.9[.]77 and 83.242.96[.]159, and cloud-hosted URLs such as http://18.116.63[.]61/ifeellike.php and http://3.135.249[.]199/prayfor.php.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
2 techniques
Initial Access
Execution
5 techniques
Execution
The downloaded script then writes a second obfuscated .vbs file to the Windows %TEMP% directory and schedules it to run later using a hidden task.
The ClickFix lure tricks users into launching a PowerShell command that downloads an obfuscated VBScript (.vbs)... PowerShell continues to be the most leveraged native binary, with cmdlets such as iwr (Invoke-WebRequest), irm (Invoke-RestMethod), and iex (Invoke-Expression) being very prolific.
The third script also creates a .cmd file in the Windows startup folder, naming it after the user’s hostname, and schedules a system restart. After the device restarts, the .cmd file launches a large DLL through rundll32.exe and attempts to deliver the final payload.
The ClickFix lure tricks users into launching a PowerShell command that downloads an obfuscated VBScript (.vbs). The downloaded script then writes a second obfuscated .vbs file to the Windows %TEMP% directory and schedules it to run later using a hidden task.
The ClickFix technique attempts to trick users into running malicious commands on their devices... It typically gives the users instructions that involve clicking prompts and copying, pasting, and running commands directly in the Windows Run dialog box, Windows Terminal, or Windows PowerShell.
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
4 techniques
Stealth
Threat actors obfuscate the JavaScript that generates the visual lures or they download parts of the code from different servers. They also employ various tactics in obfuscating malicious commands... These techniques include nested execution chains, proxy command abuse, encoding schemes such as Base64, use of string concatenation/fragmentation, and escaped characters.
“Final payloads are often ‘fileless’… launched in memory by living-off-the-land binaries (LOLBins)… code injected into LOLBins, such as msbuild.exe, regasm.exe, or powershell.exe… signs pointing to LOLBins—such as powershell, mshta, rundll32, wscript…”
Discovery
2 techniques
Discovery
Command and Control
3 techniques
Command and Control
The infrastructure commonly supports ransomware command and control (C2) servers, malware distribution, phishing campaigns, botnet management, and data exfiltration staging.
IOCs tracked for this family
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family referenced as part of campaigns leveraging the same/similar infrastructure.
Infostealer listed in observed malicious activity associated with ISPsystem-derived infrastructure.
Banking trojan and stealer targeting credentials and financial information, distributed via phishing lures and ZIP attachments, with recent enhancements for persistence.
A banking-focused infostealer delivered through a multi-stage ClickFix infection chain using obfuscated VBScript, reconnaissance, sandbox checks, persistence, and attempted DLL execution.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.