Lampion Phishing Hits Portugal With Fake Brands

How the attack worked

The Lampion banking Trojan has been active against Portuguese organizations since 2019, and researchers report a new phishing campaign still using this malware. The lure impersonates private-sector entities, with an automotive documentation agency given as an example. Victims receive an email that asks them to open a file or follow a link to complete some kind of business process or documentation request. Following the lure leads to installation of a credential-stealing remote-access tool (RAT).

Once installed, the RAT does not simply log keystrokes. It uses overlays, fake login screens placed on top of legitimate banking websites, to capture credentials as the victim attempts to log in. This means the visible banking site may look normal at first glance, but the login prompt itself is attacker-controlled.

Why it succeeded

This campaign works because it leans on ordinary business communication patterns rather than obviously suspicious content. An email referencing documentation or a process tied to a private-sector agency does not immediately look like a scam, especially to finance and accounting staff who regularly handle paperwork from outside vendors or agencies. The credential theft also happens in two stages: the phishing email delivers the RAT, and the actual theft occurs later when the victim logs into their bank, which separates the initial compromise from the moment credentials are stolen and makes the connection harder to notice.

What to watch for

• Unexpected emails claiming to be from a business agency or documentation provider you do not regularly work with
• Messages that push you to open a file or click through a link to proceed with some process
• Banking site login prompts or overlays that look unusual, mismatched, or unfamiliar compared to normal login screens
• Any sign of unexpected software installation or activity following a suspicious email

How to build resistance

Employees, especially those in finance and accounting or anyone with online banking access, should verify unexpected business-process emails through a known, trusted contact method rather than acting on the message directly. Staff should also be trained to pause and report anything unusual at a banking login screen before entering credentials, since this campaign specifically relies on convincing overlay screens to succeed. Finally, organizations should reinforce that phishing can lead to more than a stolen password, in this case a fully installed RAT, so quick reporting of any suspicious click or file opening is critical to limiting damage.

What is the Lampion banking Trojan?

Lampion is a banking Trojan that has targeted Portuguese organizations since 2019 and remains active through phishing campaigns impersonating private-sector entities.

How does Lampion steal banking credentials?

After a victim is tricked into opening a malicious file or link, Lampion deploys a credential-stealing RAT that overlays fake login screens on banking websites to capture usernames and passwords.

Who is being impersonated in this campaign?

The campaign impersonates private-sector entities, with an automotive documentation agency given as an example lure.

Who should be most concerned about this campaign?

Finance and accounting staff, along with any employee who has online banking access, are the primary targets since the end goal is capturing banking credentials.