Lampion Banking Trojan (ChePro Lineage) Multistage Phishing/Evasion Campaign Targets Portugal
Lampion Banking Trojan (ChePro Lineage) Multistage (TL-2026-1619), also tracked as Lampion Portugal Phishing Campaign, is a medium-severity malware campaign, first published 2026-07-22. It is attributed to Lampion with medium confidence, affects Microsoft Windows (rundll32.exe, Windows Script Host, Task Scheduler), maps to 23 MITRE ATT&CK techniques (T1027, T1027.001, T1033), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-1619
- Threat ID
- TL-2026-1619
- Also known as
- Lampion Portugal Phishing Campaign, Lampion Multistage Evasion Chain
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-22
- Last reviewed
- 2026-07-22
- Attribution
- Lampion
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- financial services, government administration, accounting, transport, general consumer retail banking customers
- Target regions
- portugal, spain, united kingdom
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Lampion Banking Trojan (ChePro Lineage) Multistage
Malware and tooling: ChePro, lampion, Windows Script Host (wscript.exe/cscript.exe)
Acronis Threat Research Unit identified an active phishing campaign delivering the Lampion (ChePro-lineage) Brazilian banking RAT to Portuguese-speaking users, primarily in Portugal (94.6% of detections), with smaller volumes in Spain (4.3%) and the UK (1.1%). The campaign uses a four-stage HTML/JavaScript/VBS infection chain with heavy obfuscation, junk-code padding, encrypted URLs, and HTTP range-request payload delivery to evade static analysis, culminating in a rundll32-launched RAT DLL exporting the function "jangadeiro" for remote access and data exfiltration.
How Lampion Banking Trojan (ChePro Lineage) Multistage works
Lampion is a Brazilian banking trojan derived from the ChePro malware lineage (Trojan-Banker.Win32.ChePro, first observed in Russia in October 2012, historically concentrated in Brazil and Portugal due to shared language). Lampion itself was first publicly documented on 2019-12-26 by Segurança Informática, spreading via phishing emails templated on Portuguese Government Finance & Tax communications. The family has remained active and continuously refined its delivery tradecraft through 2020-2025, including a Unit 42-documented resurgence (late 2024-early 2025) against Portuguese government, finance, and transportation organizations using ClickFix-style PowerShell lures and C2 infrastructure reuse tied back to prior Lampion infections.
The campaign profiled here (Acronis TRU, published 2026-07-21) begins with a phishing email carrying a password-protected or plain ZIP archive impersonating financial/administrative correspondence. Inside is an HTML file artificially inflated to roughly 1.3 MB with random junk content and padding, rendering a fake "SAPO Transfer" portal page. Embedded JavaScript on this page retrieves a second-stage payload from an encrypted URL and dynamically injects/executes it. Stage 2 is an obfuscated VBS downloader roughly 7 MB in size but containing only ~22 KB of functional code (the remainder is junk-code padding used to defeat static/AV signature analysis); it writes a further downloader script to a temp directory and registers a Windows Task Scheduler task to launch the next stage. Stage 3 is a ~1,000-line VBS component that enforces single-instance execution via WMI process checks, fingerprints the victim (username, hostname, BIOS, motherboard, and GPU identifiers) to build a persistent victim ID, polls command-and-control infrastructure for a payload URL, and retrieves the final payload in 10 MB HTTP range-request chunks reassembled via an ADODB.Stream object — a technique that defeats network content-inspection tools expecting a single monolithic download. Intermediate VBS files self-delete after each stage, and scheduled tasks relocate/rename downloaded artifacts and can self-restart the chain roughly every 5 minutes if a stage fails.
The final payload is a DLL roughly 750 KB of genuine code padded to a much larger on-disk footprint (researchers describe the resulting artifact size, ~750 MB in some reporting of the padded form, as being driven entirely by junk padding rather than functional complexity), deployed into a timestamp-named folder under the user's AppData directory and executed via `rundll32.exe`, invoking an exported function named "jangadeiro" (Portuguese for the fisherman who pilots a jangada raft — consistent with the malware's Brazilian cultural origin). This DLL is the operational RAT component, providing remote access, screen/window monitoring typical of Latin American/Iberian banking trojans, credential and banking-session interception, and data exfiltration back to attacker infrastructure.
Operators use geofencing/victim-tracking controls so that payloads are only delivered to victims matching expected geography/locale, restricting analysis by researchers outside the target regions and explaining the concentrated 94.6% Portugal detection rate. C2 hosts are described as time-bound and potentially reassigned, consistent with Lampion's historical use of disposable or rotated infrastructure and, in earlier campaigns, abuse of legitimate cloud hosting (AWS S3, Google Drive) for payload staging.
MITRE ATT&CK techniques used in TL-2026-1619
Defense Evasion
T1027 Obfuscated Files or Information; T1027.001 Binary Padding; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.011 Rundll32; T1497 Virtualization/Sandbox Evasion
Discovery
T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
Collection
T1056 Input Capture; T1113 Screen Capture
Execution
T1059.005 Visual Basic; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding
stealth
Initial Access
T1566 Phishing; T1566.001 Spearphishing Attachment
Impact
Affected products and versions in Lampion Banking Trojan (ChePro Lineage) Multistage
- Microsoft — Windows (rundll32.exe, Windows Script Host, Task Scheduler)
Vulnerable versions: All supported Windows desktop versions
Remediation for Lampion Banking Trojan (ChePro Lineage) Multistage
Immediate actions
- Block the identified phishing domains (auto-contabilistica.com, autoridade-contabilistica.org, autoridade-financeira.com, fat-contabislitaca.com) at DNS/proxy/firewall layer
- Quarantine and alert on inbound ZIP attachments containing oversized HTML files (>500 KB) with embedded script, especially those impersonating SAPO Transfer or Portuguese tax/finance portals
- Hunt for rundll32.exe loading DLLs from timestamp-named AppData subfolders and terminate/isolate matching endpoints
- Review Windows Task Scheduler for recently created tasks that move/rename files and restart on a ~5 minute cadence
Workarounds
- Disable Windows Script Host (wscript.exe/cscript.exe) execution policy for standard users where not operationally required
- Restrict outbound HTTP range-request behavior to trusted domains via proxy policy
Longer-term hardening
- Deploy application allowlisting to restrict rundll32/wscript/cscript execution of unsigned scripts from user-writable directories
- Enforce email attachment sandboxing/detonation for ZIP archives containing HTML+JS+VBS chains
- Implement network monitoring for chunked HTTP range-request downloads to newly registered or low-reputation domains
- User awareness training on Portuguese-language phishing lures impersonating government finance/tax and banking transfer portals
Timeline of Lampion Banking Trojan (ChePro Lineage) Multistage
- Trojan-Banker.Win32.ChePro (the malware lineage from which Lampion descends) first documented targeting Brazil and Portugal via CPL-based delivery.
- Lampion trojan first publicly documented by Segurança Informática, spreading via phishing emails templated on Portuguese Government Finance & Tax communications.
- New Lampion release observed with improvements to the VBS downloader stage, per SecurityAffairs reporting.
- Unit 42 observes increased Lampion campaign activity against dozens of Portuguese government, finance, and transportation organizations, continuing into early 2025.
- Unit 42 documents Lampion operators adding PowerShell-based ClickFix social-engineering lures to the delivery toolkit, with C2 infrastructure overlap tying the campaign to prior Lampion infections.
- SMBtech publishes coverage of the Acronis findings, corroborating the multi-stage evasion chain and jangadeiro RAT export.
- Acronis Threat Research Unit publishes analysis of an active Lampion campaign targeting Portugal with a four-stage HTML/JS/VBS/DLL infection chain, reporting 94.6% of detections in Portugal.
- ITBrief and SecurityBrief UK publish syndicated coverage confirming campaign targeting statistics and infection chain details.
Sources cited for Lampion Banking Trojan (ChePro Lineage) Multistage
- Lampion's Portugal-focused phishing campaign delivers multistage malware
- Acronis Researchers Uncover Active Lampion Malware Campaign Targeting Portugal With Multi-Stage Evasion Chain
- Lampion malware campaign targets users in Portugal
- Lampion malware campaign targets users in Portugal (SecurityBrief UK mirror)
- Lampion Is Back With ClickFix Lures
- vbs.lampion (Malware Family)
- A new trojan dubbed Lampion is targeting Portugal
- Targeting Portugal: A new trojan 'Lampion' has spread using template emails from the Portuguese Government Finance & Tax
- New release of Lampion trojan spreads in Portugal with some improvements on the VBS downloader
- Trojan ChePro, the CPL Storm
Threats related to Lampion Banking Trojan (ChePro Lineage) Multistage
- Latrodectus Loader: Three-Stage JScript/VBScript Obfuscation Delivers WMI/msiexec MSI Payload (sokingscrosshotel[.]com)
- Armored Likho APT (Eagle Werewolf) Deploys AI-Generated Loaders to Drop BusySnake Python Stealer Against Government and Power-Sector Targets
- Latrodectus Phishing Campaign Delivering LummaStealer via 302-Redirect Domain Infrastructure (lufyfeo[.]org, 36-domain cluster)
- DNS Pivoting Reveals Shared Infrastructure Across LokiBot, Bagle, Xworm, and Remcos Campaigns
- Armored Likho APT Deploys BusySnake Python Stealer with PyArmor Obfuscation Against Government and Power Infrastructure Targets
Detection coverage for TL-2026-1619
As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1619 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.