A revived Lampion banking-trojan campaign spoofed Portugal's tax authority site to trick victims into pasting a PowerShell command into the Windows Run.
Social Engineering Examples·2 sources
Between late 2024 and early 2025, Unit 42 (Palo Alto Networks) tracked a revived campaign delivering the Lampion banking trojan/infostealer, a malware family active since at least 2019 and historically focused on Portuguese banking customers, this time using the 'ClickFix' social-engineering technique. Victims at dozens of Portuguese organizations in government, finance, and transportation received phishing emails carrying a ZIP attachment containing an HTML file.
Opening the HTML redirected the victim to autoridade-tributaria[.]com, a domain built to impersonate Portugal's tax authority (Autoridade Tributária e Aduaneira). Instead of a fake CAPTCHA (the more common ClickFix pattern), this lure presented itself as a document/software-installation page instructing the user to fix a 'file preview' problem by copying a command into the Windows Run dialog (Win+R) and executing it, with the pretext embedded as a Portuguese-language code comment, '#Habilitar Visualização de ficheiro' ('Enable File Preview').
Unit 42 published its findings on May 6, 2025, in the report 'Lampion Is Back With ClickFix Lures.' Microsoft's later ClickFix research (August 2025) independently corroborated the same campaign, saying it first identified it in May 2025, that it remained active into June 2025, and that it subsequently expanded beyond Portugal to Switzerland, Luxembourg, France, Hungary, and Mexico.
The PowerShell command pasted into the Run dialog kicked off a multi-stage, heavily obfuscated script-based infection chain designed to evade detection: (1) PowerShell downloaded an obfuscated VBScript (Stage 1) loader; (2) Stage 1 wrote a second obfuscated VBS into %TEMP% and used a scheduled task to hide execution; (3) Stage 2 fetched a third VBS stager from cloud-hosted infrastructure disguised as a PHP file; (4) Stage 3 (~30-50MB, padded heavily with junk code to frustrate analysis) performed anti-analysis checks (WMI queries for installed security products, sandbox/VM detection), beaconed a victim ID (a Base64-encoded MD5 value sent via a 'dados=' GET parameter) to attacker C2 infrastructure, dropped a .cmd file into the Windows Startup folder, and created a hidden scheduled task that forced a system shutdown so the .cmd would execute on the next reboot; (5) on reboot, the .cmd launched a Stage 4 DLL loader via rundll32.exe, with the DLL filename formatted as a timestamp (YYYYMMDDHHmmSS) and fetched from a second lookalike domain, inde-faturas[.]com, using a Portuguese-word export function name.
Notably, Unit 42 found the command intended to download and execute the final Lampion payload was commented out in the observed code, so the actual banking-trojan payload never executed in the samples analyzed, leading researchers to assess this could have been a test run or an operator mistake. Lampion itself, as a malware family, is designed to steal banking credentials and other sensitive financial data from infected hosts, and later-stage components (per Microsoft/Acronis follow-on reporting) can exfiltrate host information and support broader remote access.
The lure combined a phishing email with a ZIP/HTML redirect chain to a domain, autoridade-tributaria[.]com, deliberately mimicking Portugal's national tax authority name and visual identity, an inherently high-authority, high-compliance-pressure brand for any organization or employee handling tax/financial matters. Rather than a generic 'I'm not a robot' CAPTCHA (the classic ClickFix tell), the page framed the required action as fixing a document/file-preview problem, a plausible IT-support-style task that lowers a victim's guard compared to an overt 'download and run this .exe' request.
The definitive tell, visible only in hindsight/analysis, was that the flow asked users to manually paste and execute a command in the Windows Run dialog, something no legitimate tax authority, document viewer, or software installer ever needs; this is the generic ClickFix red flag applicable to any variant of the technique.
Unit 42 identified and publicly documented the infection chain before the final Lampion payload was confirmed to execute in the wild in this specific campaign, since the payload-download command was disabled/commented out in the analyzed samples. No named victims, confirmed financial losses, or confirmed data exfiltration were reported. Microsoft's independent later research confirmed the campaign's persistence into mid-2025 and its geographic expansion beyond Portugal to Switzerland, Luxembourg, France, Hungary, and Mexico, indicating the operators continued and broadened the operation after Unit 42's initial disclosure.
This case shows ClickFix evolving beyond its signature fake-CAPTCHA presentation into a fake government-document/software-install pretext, spoofing a national tax authority to target public-sector, financial, and transportation organizations specifically, sectors with high-value credential access and low tolerance for disruption. It also demonstrates why ClickFix is effective against organizations with mature email/attachment defenses: the actual malicious action (pasting and running a command) is manually performed by the victim inside a trusted OS dialog (Win+R), bypassing many automated attachment/macro/download-based detections, and the multi-stage, junk-padded VBS chain with anti-sandbox checks was built specifically to survive analysis and evade endpoint tooling long enough to establish persistence via scheduled tasks and startup-folder execution.
Because ClickFix relies on the victim manually executing an attacker-supplied command rather than any automated exploit, the most effective defenses are: employee training that flags any instruction to paste and run commands into the Windows Run dialog (Win+R) as an automatic compromise indicator, regardless of the page's branding or claimed purpose; disabling or restricting the Run dialog and PowerShell execution policy for standard users where feasible; blocking known indicators (autoridade-tributaria[.]com, inde-faturas[.]com, and associated C2 IPs/domains); monitoring for suspicious scheduled-task creation, Startup-folder .cmd drops, and rundll32.exe launching timestamp-named DLLs; and email/attachment filtering for ZIP-wrapped HTML redirector files targeting government/finance/transport domains.
Social Engineering Examples. “Lampion Banking Trojan ClickFix Campaign vs Portuguese Government, Finance and Transport Sectors”. Accessed 19 September 2026. https://socialengineeringexamples.com/lampion-clickfix-portugal-tax-authority-2025
Consistent with past Lampion campaigns (per Unit 42), the operators likely reused established target lists and command-and-control infrastructure from prior Portuguese-banking-focused runs, and selected government, finance, and transportation-sector organizations for their high-value credential access, rather than researching individual employees the way targeted BEC actors typically do.
Because this stage targets an entire national vertical rather than named individuals, there is no realistic way to block the reconnaissance itself; the practical control is sector-wide threat-intel sharing (national CERTs, tax-authority advisories, ISACs) so organizations in flagged sectors can pre-emptively brief staff before a wave lands.
Before the campaign launched, the operators registered look-alike domains impersonating Portugal's tax authority (autoridade-tributaria[.]com) and a second lookalike domain (inde-faturas[.]com), and stood up disposable, cloud-hosted C2 servers with endpoints disguised as ordinary PHP files, a pattern consistent with common bulletproof and cloud-hosting abuse used to survive takedown attempts.
Domain-registration monitoring and typosquat/lookalike-detection services that flag newly registered domains mimicking a government agency's name, combined with proactive DNS and web-filtering blocklist feeds, can catch and block this infrastructure before or shortly after it goes live, which is exactly how Unit 42's and Microsoft's published indicator lists get used downstream.
The campaign delivered a phishing email carrying a ZIP attachment containing an HTML redirector file, a long-standing Lampion delivery pattern per Unit 42's reporting.
Email gateway filtering that inspects or blocks ZIP-wrapped HTML files, a known malware-delivery pattern, along with attachment sandboxing, stops the chain here, before any user interaction is required.
Opening the HTML redirected the victim to the spoofed tax-authority site, which presented a fake document or software-installation page rather than the more common fake CAPTCHA, framing the required action as fixing a file-preview problem to lower the victim's suspicion.
Browser isolation or web filtering that blocks or sandboxes newly registered and unclassified domains reached via email links, combined with employee training on government-impersonation pretexts specifically, reduces the chance a victim ever reaches the point of interacting with the lure page.
The lure instructed the victim to manually copy a PowerShell command, containing a Portuguese-language comment framing it as enabling file preview, and paste and execute it in the Windows Run dialog (Win+R), the core ClickFix action that hands execution over to the victim rather than relying on an automated exploit.
Employee training that treats any instruction to paste and run a command in the Run dialog, a terminal, or PowerShell as an automatic compromise indicator, regardless of the page's branding or claimed purpose, is the single highest-leverage control in the chain, since it targets the one step that requires active human participation and has no legitimate equivalent.
The executed command downloaded a heavily obfuscated VBScript (Stage 1), which wrote a second obfuscated VBS to %TEMP% (Stage 2) using a hidden scheduled task rather than direct execution to break up the process tree, which in turn fetched a third, junk-padded VBS (Stage 3, roughly 30-50MB) from cloud infrastructure disguised as a PHP file; Stage 3 performed WMI-based security-product checks and sandbox/VM detection before beaconing a Base64-encoded victim ID to the attacker's C2.
Endpoint detection tooling capable of analyzing obfuscated and bloated VBScript locally, and monitoring or restricting unusual PowerShell-to-VBS-to-scheduled-task chains, plus tightening PowerShell and WScript/CScript execution policy for standard users, can catch the infection mid-chain even though no single stage looks overtly malicious in isolation.
Stage 3 dropped a .cmd file named after the victim's hostname into the Windows Startup folder and created a hidden scheduled task that forced a system shutdown, so the .cmd would execute automatically on the next reboot and launch the Stage 4 DLL loader via rundll32.exe.
Monitoring and alerting on scheduled-task creation that triggers shutdown or restart events, unexpected Startup-folder writes, and rundll32.exe invocations with unusual export-function names catches this persistence mechanism, which has no legitimate equivalent on a standard endpoint.
The Stage 4 DLL, named from the infection timestamp (YYYYMMDDHHmmSS) and using a Portuguese-word export function unique to each victim, was fetched from the second lookalike domain (inde-faturas[.]com); Unit 42 found the subsequent command to download and execute the actual Lampion banking-trojan payload had been commented out in the observed samples.
Blocking the published indicators (both lookalike domains and their associated C2 IPs) at the DNS or web-filtering layer, and treating any binary download from a domain absent from the browsing history that preceded it as suspicious, can stop the chain from reaching a completed infection even at this late stage.
Objective completion (banking credential theft and broader access, not completed in this run): Had the payload-download command not been disabled, this final step would have installed the Lampion banking-infostealer payload itself, enabling theft of banking credentials and other sensitive financial data, plus, per Microsoft and Acronis follow-on reporting, broader host-information exfiltration and remote-access capability; in the samples Unit 42 analyzed, this step never executed.
Because this stage represents the completed objective rather than a discrete technical action, there is no meaningful control that operates here; the realistic countermeasures are upstream, at the delivery, execution, and persistence stages (3, 5, 6, 7, and 8), since detecting a fully installed banking trojan after the fact typically means the compromise has already succeeded.
Browse by what this case has in common with others in the library.
A victim searching for the AnyDesk remote-access tool hit a typosquatted site with a fake Cloudflare Turnstile.
Lazarus-linked operators built polished fake job-interview sites impersonating Coinbase, Kraken, Circle and other crypto firms.
After going quiet in March 2025, Gootloader returned in November 2025 with a glyph-swapping web font and a malformed ZIP…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A blogger paid $89.95 to an online data broker (CellTolls.com) to buy retired Gen. Wesley Clark's cell-phone call log obtained…
A Houston- and California-based ring spoofed business emails to trick five companies and a New Jersey township into wiring over…
A mass-phishing malware infection at Target's small HVAC contractor harvested vendor-portal credentials that attackers reused to pivot.
A Chicago hairstylist wired $20,000 of her own money to scammers after a caller impersonating Bank of America.
Russian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
A long-running, India-based network of call centres impersonated the Canada Revenue Agency and RCMP in mass vishing calls that threatened…
Impersonators posing as two School District of Philadelphia vendors switched payments to ACH and diverted nearly $700,000 into fraud accounts.
A Dominican Republic call-center network ran a multi-role "grandparent"/"family-in-need-of-bail" scam: openers posed as a distressed grandchild.
Tejay Fletcher founded and ran iSpoof, a Bitcoin-subscription caller-ID spoofing and OTP-interception platform that let fraudsters impersonate bank.
eSentire's Threat Response Unit blocked 10 separate attacks across six unnamed law firms in Jan-Feb 2023, foiling two parallel campaigns.
A blogger paid $89.95 to an online data broker (CellTolls.com) to buy retired Gen. Wesley Clark's cell-phone call log obtained…
DOJ alleges Ghanaian twins Jamal and Kamal Abubakari and U.S.-based Amanda Opoku-Boachie ran an AI-video-enabled romance fraud ring that used…
A 16-member Colombian crime ring called and WhatsApp-messaged bank customers posing as fraud-prevention officers.
Social Engineering Examples