--- title: Lampion's Portugal-focused phishing campaign delivers multistage malware description: Acronis Threat Research Unit (TRU) has identified an active Lampion malware campaign targeting Portuguese users through phishing emails masquerading as financial and administrative communications. canonical_url: https://www.acronis.com/en/tru/posts/lampions-portugal-focused-phishing-campaign-delivers-multistage-malware/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 21 July 2026 # Lampion's Portugal-focused phishing campaign delivers multistage malware Acronis Threat Research Unit (TRU) has identified an active Lampion malware campaign targeting Portuguese users through phishing emails masquerading as financial and administrative communications. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** Other languages available:[Português](https://www.acronis.com/pt/tru/posts/lampions-portugal-focused-phishing-campaign-delivers-multistage-malware/) **Authors:** Jozsef Gegeny, Ilia Dafchev, David Catalan Alegre ## Summary * [Acronis Threat Research Unit (TRU)](https://www.acronis.com/en/tru/about/) identified an active Lampion malware campaign targeting Portuguese users through phishing emails masquerading as financial and administrative communications. * First publicly documented in December 2019, [Lampion is a Brazilian banking malware family](https://seguranca-informatica.pt/targeting-portugal-a-new-trojan-lampion-has-spread-using-template-emails-from-the-portuguese-government-finance-tax/), derived from the ChePro lineage, that has consistently targeted Portugal and other Portuguese-speaking users rather than Brazilian victims. * Initial payloads are delivered through ZIP archives containing heavily obfuscated HTML files designed to evade static detection and analysis. The HTML stage retrieves and executes additional script from attacker-controlled infrastructure, leading to the deployment of a multistage VBS infection chain. * Each stage employs extensive obfuscation techniques, including junk code, encrypted strings and dynamically generated scripts, significantly inflating file sizes while concealing core functionality. The infection chain is deliberately fragmented across multiple independent execution stages, complicating behavioral analysis and reducing the visibility of malicious activity. * Telemetry indicates that the activity is overwhelmingly concentrated in Portugal, reinforcing the assessment that Lampion remains a highly targeted threat focused on Portuguese victims. ## Details of the campaign As part of the Lampion malware campaign we’ve been tracking in recent weeks, we observed a wave of phishing emails designed to impersonate routine financial or administrative communications. The activity appears to be highly targeted and focuses overwhelmingly on victims in Portugal (94.6% of detections; see Statistics), leveraging Portuguese-language lures and local business impersonation to increase credibility. Before examining each component in detail, the figure below provides a high-level overview of the infection chain observed in this campaign. The attack progresses through multiple staged components, beginning with a phishing email and culminating in the deployment of the Lampion RAT payload. ![Image 1: Infection chain overview](https://staticfiles.acronis.com/images/content/4faf34469203882cb35316b1849ebd7c.png) Infection chain overview Below is an example message detected in June 2026, reflecting the most recent iteration of this activity: ![Image 2: Figure 1: Phishing email](https://staticfiles.acronis.com/images/content/63cd67caa89b7ed9d70eed31602c0fc0.png) Figure 1: Phishing email This phishing email uses a simple financial pretext to encourage the recipient to open an attachment. It claims to include a “payment receipt,” which is a common social engineering tactic in malware campaigns: Presenting the attachment as an important transactional document to increase the likelihood of execution. The message is also padded with credibility markers such as a confidentiality notice, an automated mailbox disclaimer and a full business signature with address and social media presence. These elements are typical in Lampion-related phishing lures, where attackers recycle professional-looking templates to blend into legitimate business communication. The malicious attachment is delivered as a ZIP file named **COMPROVATIVO-JUNHO_OJLWnObxFOyTZkx_01-06-2026_104.zip**. Once extracted, it contains a relatively large web document (~1.3 MB), artificially inflated with nonsensical markup and randomized strings, likely intended to hinder analysis and evade detection. When opened in a browser, it renders a convincing fake SAPO Transfer page. SAPO is a widely recognized Portuguese internet portal operated by Altice Portugal, offering services such as email, news and online tools, and its branding is abused here to increase trust and encourage user interaction with the malicious content. This abuse of SAPO branding is not new; SAPO impersonation has featured in prior Lampion campaigns. ![Image 3: Figure 2: Fake SAPO file transfer page](https://staticfiles.acronis.com/images/content/48ec554e8812f0d79648a50a802f2d0c.png) Figure 2: Fake SAPO file transfer page In the background, the malicious JavaScript embedded within the rendered page initiates the retrieval of the next-stage payload from an encrypted URL: ![Image 4: Figure 3: Deobfuscated next-stage downloader](https://staticfiles.acronis.com/images/content/d3edeba9557cb63a4c84a7d4a6dfda35.png) Figure 3: Deobfuscated next-stage downloader Upon decoding, the string 39103C3420686D562A36077B0D2C3A2D2C20281F3A3D3E340D04642A1A145C211A7D615775694A382C23 resolves to: hxxps://fat-contabislitaca[.]com/js/1898.php Once the download is completed successfully, the retrieved JavaScript is dynamically injected into the already loaded document and executed. The script achieves this by creating a new