Lampion Banking Malware Deploys ClickFix Lures to Harvest Banking Information

A newly identified cyber campaign, orchestrated by actors behind Lampion banking malware, has escalated threats against Portuguese organizations, with a significant uptick observed between late 2024 and early 2025.

The campaign, primarily targeting entities across government, finance, and transportation sectors, is notable for its integration of the emerging “ClickFix” social engineering lure a tactic that manipulates victims into executing malicious system commands under the guise of technical remediation.

Lampion, an infostealer active since at least 2019, continues to evolve its tactics to evade detection and maximize data theft, particularly of sensitive banking information.

The latest attack wave mirrors previous campaigns in target selection and use of heavily obfuscated Visual Basic (VB) scripting, but stands out by adopting the ClickFix method, which has recently gained traction among diverse malware families.

Complex Multi-Stage Infection Chain

According to the Report, the infection sequence commences with a phishing email containing a ZIP archive.

Inside, a malicious HTML document redirects users to a website impersonating the legitimate Portuguese tax authority.

Victims are then prompted to copy and execute a PowerShell command the essence of the ClickFix lure purportedly to “enable file preview” or resolve technical issues.

This command discreetly downloads and launches an obfuscated VBScript from a remote server, igniting a sophisticated, multi-stage attack chain.

Each stage of the malware executes as a separate process, complicating forensic efforts by breaking up the process tree and camouflaging malicious actions as isolated events.

• Stage 1: The initial VBScript, bloated with junk variables and indirect ASCII encoding, writes a second-stage, equally obfuscated script to the system’s temporary directory. Rather than executing directly, it schedules the subsequent stage via a hidden Windows task at a random future time.
• Stage 2: This downloader retrieves another VBScript stager from a cloud-hosted server, disguised as a PHP file.
• Stage 3: A robust, large VBScript (30–50 MB), equipped with evasion and reconnaissance capabilities, checks for security solutions, gathers machine fingerprints, and communicates encoded identifiers to the command-and-control (C2) infrastructure.
• Stage 4: The final payload comprises a massive DLL loader (>700 MB), fetched from a cloud destination, with execution transpiring via a startup-scheduled command and triggered by system reboot. The DLL’s entry point references functions named in Portuguese, diverging from the randomized function identifiers typical of earlier Lampion samples.

While this observed campaign did not ultimately download the final Lampion payload (the relevant code was commented out), the infection chain’s sophistication indicates continued malware development and possible future deployment of more destructive final stages.

Lampion’s reliance on multi-layered obfuscation and staged scheduling, often leveraging scheduled tasks and benign-looking scripts, hinders detection by traditional security tools.

The recent adoption of ClickFix techniques further increases risk by circumventing common user skepticism about macros or executable attachments.

Security specialists recommend proactive user training on ClickFix lures, vigilant monitoring for unusual clipboard and PowerShell activity, and employing behavioral analytics for identifying obfuscated scripting attacks.

Advanced endpoint protection platforms, like Palo Alto Networks Cortex XDR with its VBS Local Analysis Module, have demonstrated heightened efficacy in detecting these variants by recognizing obfuscated script behaviors.

Lampion’s integration of the ClickFix tactic exemplifies the rapid evolution of malware delivery techniques in financial cybercrime.

As criminals adopt increasingly convincing social engineering strategies, organizations – especially in Portuguese-speaking markets must bolster technical and educational defenses to mitigate these advanced persistent threats.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates