Lampion Banking Trojan ClickFix Campaign vs Portuguese Government, Finance and Transport Sectors

What Happened

Between late 2024 and early 2025, Unit 42 (Palo Alto Networks) tracked a revived campaign delivering the Lampion banking trojan/infostealer, a malware family active since at least 2019 and historically focused on Portuguese banking customers, this time using the 'ClickFix' social-engineering technique. Victims at dozens of Portuguese organizations in government, finance, and transportation received phishing emails carrying a ZIP attachment containing an HTML file. Opening the HTML redirected the victim to autoridade-tributaria[.]com, a domain built to impersonate Portugal's tax authority (Autoridade Tributária e Aduaneira). Instead of a fake CAPTCHA (the more common ClickFix pattern), this lure presented itself as a document/software-installation page instructing the user to fix a 'file preview' problem by copying a command into the Windows Run dialog (Win+R) and executing it, with the pretext embedded as a Portuguese-language code comment, '#Habilitar Visualização de ficheiro' ('Enable File Preview'). Unit 42 published its findings on May 6, 2025, in the report 'Lampion Is Back With ClickFix Lures.' Microsoft's later ClickFix research (August 2025) independently corroborated the same campaign, saying it first identified it in May 2025, that it remained active into June 2025, and that it subsequently expanded beyond Portugal to Switzerland, Luxembourg, France, Hungary, and Mexico.

How the Attack Worked

The PowerShell command pasted into the Run dialog kicked off a multi-stage, heavily obfuscated script-based infection chain designed to evade detection: (1) PowerShell downloaded an obfuscated VBScript (Stage 1) loader; (2) Stage 1 wrote a second obfuscated VBS into %TEMP% and used a scheduled task to hide execution; (3) Stage 2 fetched a third VBS stager from cloud-hosted infrastructure disguised as a PHP file; (4) Stage 3 (~30-50MB, padded heavily with junk code to frustrate analysis) performed anti-analysis checks (WMI queries for installed security products, sandbox/VM detection), beaconed a victim ID (a Base64-encoded MD5 value sent via a 'dados=' GET parameter) to attacker C2 infrastructure, dropped a .cmd file into the Windows Startup folder, and created a hidden scheduled task that forced a system shutdown so the .cmd would execute on the next reboot; (5) on reboot, the .cmd launched a Stage 4 DLL loader via rundll32.exe, with the DLL filename formatted as a timestamp (YYYYMMDDHHmmSS) and fetched from a second lookalike domain, inde-faturas[.]com, using a Portuguese-word export function name. Notably, Unit 42 found the command intended to download and execute the final Lampion payload was commented out in the observed code, so the actual banking-trojan payload never executed in the samples analyzed, leading researchers to assess this could have been a test run or an operator mistake. Lampion itself, as a malware family, is designed to steal banking credentials and other sensitive financial data from infected hosts, and later-stage components (per Microsoft/Acronis follow-on reporting) can exfiltrate host information and support broader remote access.

The Lure & the Tell

The lure combined a phishing email with a ZIP/HTML redirect chain to a domain, autoridade-tributaria[.]com, deliberately mimicking Portugal's national tax authority name and visual identity, an inherently high-authority, high-compliance-pressure brand for any organization or employee handling tax/financial matters. Rather than a generic 'I'm not a robot' CAPTCHA (the classic ClickFix tell), the page framed the required action as fixing a document/file-preview problem, a plausible IT-support-style task that lowers a victim's guard compared to an overt 'download and run this .exe' request. The definitive tell, visible only in hindsight/analysis, was that the flow asked users to manually paste and execute a command in the Windows Run dialog, something no legitimate tax authority, document viewer, or software installer ever needs; this is the generic ClickFix red flag applicable to any variant of the technique.

Outcome

Unit 42 identified and publicly documented the infection chain before the final Lampion payload was confirmed to execute in the wild in this specific campaign, since the payload-download command was disabled/commented out in the analyzed samples. No named victims, confirmed financial losses, or confirmed data exfiltration were reported. Microsoft's independent later research confirmed the campaign's persistence into mid-2025 and its geographic expansion beyond Portugal to Switzerland, Luxembourg, France, Hungary, and Mexico, indicating the operators continued and broadened the operation after Unit 42's initial disclosure.

Why It Matters

This case shows ClickFix evolving beyond its signature fake-CAPTCHA presentation into a fake government-document/software-install pretext, spoofing a national tax authority to target public-sector, financial, and transportation organizations specifically, sectors with high-value credential access and low tolerance for disruption. It also demonstrates why ClickFix is effective against organizations with mature email/attachment defenses: the actual malicious action (pasting and running a command) is manually performed by the victim inside a trusted OS dialog (Win+R), bypassing many automated attachment/macro/download-based detections, and the multi-stage, junk-padded VBS chain with anti-sandbox checks was built specifically to survive analysis and evade endpoint tooling long enough to establish persistence via scheduled tasks and startup-folder execution.

Defenses

Because ClickFix relies on the victim manually executing an attacker-supplied command rather than any automated exploit, the most effective defenses are: employee training that flags any instruction to paste and run commands into the Windows Run dialog (Win+R) as an automatic compromise indicator, regardless of the page's branding or claimed purpose; disabling or restricting the Run dialog and PowerShell execution policy for standard users where feasible; blocking known indicators (autoridade-tributaria[.]com, inde-faturas[.]com, and associated C2 IPs/domains); monitoring for suspicious scheduled-task creation, Startup-folder .cmd drops, and rundll32.exe launching timestamp-named DLLs; and email/attachment filtering for ZIP-wrapped HTML redirector files targeting government/finance/transport domains.