Lampion Is Back With Click Fix Lures
Summary: Unit 42 researchers uncovered a campaign targeting dozens of Portuguese organizations in government, finance and transportation, attributed to the actors behind Lampion malware, an infostealer focused on banking information that has been active since at least 2019. The infection chain begins with a phishing email carrying a malicious ZIP whose HTML file redirects victims to a site mimicking the Portuguese tax authority, which prompts them to copy a PowerShell command into the Run dialog - a ClickFix lure - leading to obfuscated VBS stages, a hidden scheduled task, and a DLL loader over 700 MB, though the final Lampion payload was commented out in the activity observed.
Bottom line: A 700 MB loader DLL is sized specifically so defenders cannot upload it to crowd-sourced threat intelligence platforms, and the final payload was left commented out - which Unit 42 says could mean a mistake or a testing phase for the next wave.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026