Lampion Stealer Resurfaces with ClickFix Attack to Steal User Credentials Stealthily

Lampion Stealer has resurfaced with a ClickFix-driven campaign aimed at stealing credentials, with researchers noting the operation has run continuously since at least June 2024 after its 2019 initial discovery. The campaign targets Portuguese banks and uses a multi-stage infection chain to evade detection while maintaining persistence on victims’ systems, with significant evolution documented by security researchers.

According to Bitsight, the threat actors employ ClickFix lures, compromised email accounts, and a distributed infrastructure that has kept infections active in the hundreds and generated dozens of new daily compromises. In late September 2024 they began using their own domains for hosting, and in mid-December 2024 introduced ClickFix social engineering that persuades victims to paste malicious commands into Windows Run dialogs; by late June 2025 they added new persistence mechanisms in the initial payload stages.

The Lampion stealer itself has evolved into a single DLL around 700MB, with two encrypted ZIP files in its resources, protected by VMProtect obfuscation to hinder analysis and enabling robust anti-debugging features.