Lampion Banking Trojan Evolves: 700MB Bloatware DLL and ClickFix VBS Script Target Brazilian Users

Researchers at BitSight have uncovered a long-running spam campaign operated by a Brazilian threat group behind the Lampion banking Trojan, an information-stealing malware family active since 2019. The latest report reveals an updated infection chain, new persistence mechanisms, and a 700MB obfuscated DLL payload, signalling the actors’ continued emphasis on stealth and evasion.

The infection flow remains phishing-based, with fake Portuguese-language financial emails that trick victims into opening attachments, typically starting with a ZIP file and a sequence of obfuscated Visual Basic scripts that culminate in the deployment of a DLL stealer.

Over the past year, the group has refined its methods across three phases: September 2024 switched from download links to direct ZIP attachments, December 2024 adopted the ClickFix social engineering lure, and June 2025 introduced persistence mechanisms in the first-stage script. The final payload—a single 700MB DLL—embeds encrypted ZIP archives to evade antivirus scanners and is designed to communicate with a C2 server hosted at 83.242.96[.]159.

According to BitSight, the new component set also includes a 23MB VBS script that monitors and terminates multiple web browsers as an anti-analysis measure.