Artificial Intelligence AI Cybersecurity: Defeating the Bloated Lampion Trojan

Old malware doesn't die. It just gets fat. While the security industry spends billions chasing the newest zero-days and sophisticated exploits, threat actors are still finding massive success with simple, legacy tools. The Lampion banking Trojan is a perfect case in point.

Lampion first appeared around the December 2019 holiday season. It's a Brazilian-origin banking Trojan stemming from the ChePro lineage. In a sector where threat actors usually target their own domestic users—often due to proximity and local banking knowledge—Lampion's operators decided to take a different path. They focused their efforts almost exclusively on Portuguese organizations.

The Brazilian banking Trojan targeting Portuguese organizations

The connection between Brazilian threat groups and Portuguese victims is linguistic and operational. Targeting Portugal makes sense for these actors. It allows them to leverage their native Portuguese language for highly convincing social engineering lures while remaining outside the direct jurisdiction of Portuguese law enforcement agencies.

Recent telemetry compiled by GBHackers shows 94.6% of detections are concentrated in Portugal, with minor spillover to Spain (4.3%) and the UK (1.1%).

This is part of a broader shift in regional cybercrime dynamics. The Latin American threat landscape is expanding, as detailed in our analysis of Operation Escaneo, which shows how groups are exporting successful regional campaigns internationally.

From payment receipts to fake SAPO portals

Historically, Lampion campaigns mimic public-sector communications, such as notices from the Portuguese Tax and Customs Authority. In recent campaigns, however, the actors have pivoted toward private-sector lures.

Attackers now send phishing emails claiming to be from private businesses—specifically, an automotive documentation agency. The email alerts the target to a missing payment or an urgent invoice receipt. It includes professional disclaimers, automated mailbox warnings, and credible signatures to bypass immediate suspicion.

The payload is packaged inside a ZIP archive named similarly to the lure, such as COMPROVATIVO-JUNHO_01-06-2026_104.zip.

Inside the ZIP archive sits an HTML file that has been bloated to approximately 1.3MB. Open the HTML file and it loads a convincing replica of a SAPO Transfer portal, which is a popular file-sharing service in Portugal operated by Altice Portugal. While the victim thinks they are viewing a file transfer page, hidden JavaScript executes.

As reported by Cyber Press, the HTML document is artificially inflated with meaningless markup and random strings, a tactic designed to disrupt static analysis.

In the background, the embedded script decrypts a remote URL—for instance, hxxps://fat-contabislitaca[.]com/js/1898.php. It then downloads the next stage and dynamically injects the javascript into the active document object model (DOM) of the browser, avoiding writing files directly to disk at this early stage. This injection bypasses traditional file-based antivirus scanners.

The multi-stage infection chain and the 750MB payload

Once the dynamic script runs, the second-stage payload is pulled down. This is a VBScript file that is heavily disguised as another receipt (e.g., Comprovativo_Junho_15-06-2026-WjGAxGL.vbs).

This VBS file is bloated to about 7MB, but the actual functional code is only 22KB. The rest is junk variables, unused functions, and random strings. Its primary goal is to create scheduled tasks and write downloader scripts to the system's %TEMP% directory.

The final VBS stage is a complex script consisting of roughly 1,000 lines of code. It performs a complete operational sequence:

1. Enforces a single instance using Windows Management Instrumentation (WMI) to query active process command lines.
2. Purges any other VBS scripts residing in the %TEMP% directory.
3. Computes a unique victim identifier (victimId) by hashing key system properties, specifically the user, hostname, BIOS, motherboard description, and GPU: MD5(user|host|BIOS|MB|GPU).
4. Sends a Base64-encoded analytics beacon back to the command-and-control (C2) server, including security software details.
5. Polls the C2 to fetch a payload URL and payload name.
6. Downloads the final payload in 10MB ranges using HTTP Range requests.
7. Reassembles the fragments via ADODB.Stream and saves the file in %APPDATA% under a timestamp-named folder.

The payload DLL is massive, weighing in at roughly 750MB. This extreme size is not due to functional complexity; it is an anti-analysis evasion strategy. The malware utilizes binary padding to evade security sandboxes, which often skip files exceeding 100MB or 200MB to preserve system performance. Lampion executes this payload using Windows' rundll32.exe to run the export named jangadeiro.

Once running, the DLL functions as a Remote Access Trojan (RAT), allowing the threat actor to inject HTML overlay screens onto Portuguese banking sites to harvest credentials. This method of credential harvesting mirrors other Trojan campaigns. For comparison on how banking Trojans hijack systems, see our report on the NFCShare Android Malware.

This observation aligns with a report from SC Media detailing how Lampion's operators have kept their techniques largely unchanged because they remain highly effective.

Why Artificial Intelligence Cybersecurity Threats bypass standard scans

Many modern security practices rely on automated file analysis. However, Lampion exploits a well-known vulnerability in these defenses. Modern defenses use specialized machine learning models and AI filters to inspect incoming executables. But scanning a 750MB file takes significant CPU and memory.

To prevent scanning pipelines from locking up, many systems impose strict file size limits on analyzed files. Any file above 100MB or 200MB is waved through unchecked. By packing the DLL with over 700MB of junk bytes and downloading it in 10MB HTTP range segments, the malware exploits these optimization limits.

Even an advanced autonomous agent or agentic AI scanner may overlook this threat because the payload is reassembled locally and exceeds analysis thresholds. As threat actors refine their methods, defending against artificial intelligence cybersecurity threats requires securing endpoints against these basic payload-padding techniques.

Historical studies by IBM Security emphasize that attackers will always choose the path of least resistance. Rather than writing sophisticated exploits, they bypass secure perimeters by inflating legacy code.

Defending against Lampion: A quick tutorial

Securing corporate endpoints against Lampion requires focusing on its distinct infection steps.

1. Block ZIP-attached HTML files: Most business processes do not require incoming HTML files inside ZIP archives. Block these at the email gateway.
2. Monitor Scheduled Tasks: Look for tasks creating command executions like cmd /c move into the %APPDATA% directory, or running VBS files.
3. Audit Rundll32 Execution: Monitor rundll32.exe calling DLLs from timestamped subfolders under %APPDATA%. Watch specifically for export names carrying Brazilian or Portuguese references, like jangadeiro.
4. Detect ADODB.Stream reassembly: Alert on local VBS scripts executing reassembly tasks via ADODB within %TEMP%.

By implementing these detection practices, security teams can halt Lampion before it reaches its final, bloated stage.