Lampion banking trojan ClickFix campaign in Portugal (2025)

Consistent with past Lampion campaigns (per Unit 42), the operators likely reused established target lists and command-and-control infrastructure from prior Portuguese-banking-focused runs, and selected government, finance, and transportation-sector organizations for their high-value credential access, rather than researching individual employees the way targeted BEC actors typically do.

Before the campaign launched, the operators registered look-alike domains impersonating Portugal's tax authority (autoridade-tributaria[.]com) and a second lookalike domain (inde-faturas[.]com), and stood up disposable, cloud-hosted C2 servers with endpoints disguised as ordinary PHP files, a pattern consistent with common bulletproof and cloud-hosting abuse used to survive takedown attempts.

The campaign delivered a phishing email carrying a ZIP attachment containing an HTML redirector file, a long-standing Lampion delivery pattern per Unit 42's reporting.

Opening the HTML redirected the victim to the spoofed tax-authority site, which presented a fake document or software-installation page rather than the more common fake CAPTCHA, framing the required action as fixing a file-preview problem to lower the victim's suspicion.

The lure instructed the victim to manually copy a PowerShell command, containing a Portuguese-language comment framing it as enabling file preview, and paste and execute it in the Windows Run dialog (Win+R), the core ClickFix action that hands execution over to the victim rather than relying on an automated exploit.

The executed command downloaded a heavily obfuscated VBScript (Stage 1), which wrote a second obfuscated VBS to %TEMP% (Stage 2) using a hidden scheduled task rather than direct execution to break up the process tree, which in turn fetched a third, junk-padded VBS (Stage 3, roughly 30-50MB) from cloud infrastructure disguised as a PHP file; Stage 3 performed WMI-based security-product checks and sandbox/VM detection before beaconing a Base64-encoded victim ID to the attacker's C2.

Stage 3 dropped a .cmd file named after the victim's hostname into the Windows Startup folder and created a hidden scheduled task that forced a system shutdown, so the .cmd would execute automatically on the next reboot and launch the Stage 4 DLL loader via rundll32.exe.

The Stage 4 DLL, named from the infection timestamp (YYYYMMDDHHmmSS) and using a Portuguese-word export function unique to each victim, was fetched from the second lookalike domain (inde-faturas[.]com); Unit 42 found the subsequent command to download and execute the actual Lampion banking-trojan payload had been commented out in the observed samples.

Objective completion (banking credential theft, not completed in this run): Had the payload-download command not been disabled, this final step would have installed the Lampion banking-infostealer payload itself, enabling theft of banking credentials and other sensitive financial data; in the samples Unit 42 analyzed, this step never executed.