Lampion RAT Distributed via 750MB Fake Payment Receipts Targeting Portugal
Hackers are deploying the Lampion RAT through sophisticated phishing emails disguised as payment receipts, primarily targeting users in Portugal with a multi-stage infection chain.
Cybercriminals are actively distributing the Lampion remote access trojan (RAT) via phishing campaigns that impersonate legitimate payment receipt notifications, with a significant focus on users in Portugal. The campaign leverages familiar financial terminology and convincing business details within its lures, aiming to trick recipients into opening malicious attachments. The attackers have also employed an unusual tactic of using extremely large file sizes for their payloads, a strategy designed to overwhelm security analysis tools and evade detection.
The infection process begins with phishing emails that appear to be routine financial or administrative communications. These emails contain a ZIP archive, purportedly holding a payment receipt. Upon opening the ZIP file, users are presented with an HTML document. This HTML file is heavily padded with meaningless code and random strings, a technique intended to obscure its malicious nature and make it difficult for automated security scanners to identify. The file size inflation, with one analyzed ZIP attachment being approximately 1.3MB, serves as a deceptive measure.
Once the padded HTML file is opened, it displays a fake interface mimicking a trusted Portuguese online service, such as a SAPO Transfer page. This visual deception is intended to reassure the victim while hidden JavaScript code within the page silently downloads the next stage of the malware. This layered approach, starting with a seemingly innocuous document and progressing through obfuscated code, highlights the evolving sophistication of phishing attacks.
The downloaded JavaScript then triggers the execution of Visual Basic Script (VBS) files, which continue the theme of payment documents with filenames like "Comprovativo_Junho_15-06-2026-WjGAxGL.vbs." These VBS scripts are also padded with junk data, with one analyzed file being around 7MB despite containing minimal actual malicious code. This tactic further complicates analysis and increases the likelihood of the malware slipping past security defenses.
The final VBS component performs crucial reconnaissance, including checking for victims and gathering system information, before contacting command-and-control (C2) infrastructure. It can establish persistence by creating scheduled tasks and remove any competing VBS files from temporary folders. The malware then downloads the primary RAT payload, a DLL file, into a timestamp-named folder within the user's AppData directory. This download is often performed in chunks using HTTP range requests.
The ultimate payload is a massive DLL file, reportedly around 750MB. However, its sheer size is largely attributed to padding, a known Lampion tactic used to hinder scanning, transfer, and analysis. Once executed, this DLL, using an exported function named 'jangadeiro,' functions as the core RAT, granting attackers remote access to the compromised system. This allows for potential data theft and full system compromise.
This campaign aligns with a broader trend of malware targeting European banking users through localized social engineering tactics. The use of fake financial documents, layered obfuscation, and staged payloads is a common strategy employed by threat actors to maximize their reach and impact. The heavy concentration of detections in Portugal (94.6 percent) indicates a deliberate effort by the operators to tailor their lures and language to a specific audience.
Security professionals are advised to investigate unusually large DLL files found in AppData directories, particularly those within timestamped folders. Monitoring scheduled tasks that involve commands like 'cmd /c move' or 'rundll32,' as well as suspicious VBS files in temporary folders, is also recommended. Verifying unexpected financial documents through a separate, trusted communication channel before opening them is a critical preventative measure.