{"id":14538,"date":"2026-07-24T10:04:43","date_gmt":"2026-07-24T10:04:43","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/07\/24\/hackers-hide-750mb-lampion-rat-inside-fake-payment-receipt-emails\/"},"modified":"2026-07-24T10:04:43","modified_gmt":"2026-07-24T10:04:43","slug":"hackers-hide-750mb-lampion-rat-inside-fake-payment-receipt-emails","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/07\/24\/hackers-hide-750mb-lampion-rat-inside-fake-payment-receipt-emails\/","title":{"rendered":"Hackers Hide 750MB Lampion RAT Inside Fake Payment Receipt Emails"},"content":{"rendered":"

Hackers Hide 750MB Lampion RAT Inside Fake Payment Receipt Emails
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Hackers are using fake payment receipt emails to deliver a 750MB Lampion remote access trojan to targets in Portugal. <\/p>\n

The campaign relies on familiar financial language, convincing business details, and oversized files designed to slow down analysis and evade security checks.<\/a><\/p>\n

The attack begins with phishing emails that pose as routine financial or administrative messages. <\/p>\n

Recipients are urged to open a ZIP attachment that appears to contain a payment receipt, turning an ordinary business task into the first step of a malware infection.<\/a><\/p>\n

After the second stage of the attack was examined, analysts from Acronis identified the activity as a new Lampion campaign focused heavily on Portuguese users. <\/p>\n

The researchers found that 94.6 percent of detections were in Portugal, showing that the operators continue to tailor their lures, language, and branding to a specific audience.<\/a><\/p>\n

Lampion is a Brazilian banking malware family first documented in 2019 and linked to the ChePro lineage. <\/p>\n

Although it originated in Brazil, its operators have repeatedly targeted Portuguese-speaking victims, using localized scams to make malicious messages look more credible.<\/p>\n

\n
\"Infection
Infection chain overview (Source \u2013 Acronis)<\/figcaption><\/figure>\n<\/div>\n

The latest activity shows how older banking malware can remain effective when attackers improve the delivery process. <\/p>\n

Instead of placing everything in one file, the operators spread the infection across several stages, making it harder for users and security teams to see the full attack chain.<\/a><\/p>\n

Acronis said in a report<\/a> shared with Cyber Security News (CSN) that the campaign uses ZIP archives, padded HTML files, JavaScript, and several Visual Basic Script stages before deploying the final payload. <\/p>\n

This approach resembles the evolving tactics covered in\u00a0Lampion ClickFix attack campaign<\/a>, where attackers also used social engineering and layered scripts to avoid detection.<\/a><\/p>\n

Hackers Hide 750MB Lampion RAT<\/strong><\/h2>\n

The phishing message uses a payment receipt as its central lure because the subject is familiar and urgent. <\/p>\n

It includes credibility markers such as confidentiality notices, automated mailbox text, business addresses, and social media references to make the email blend into normal corporate communication.<\/a><\/p>\n

One observed ZIP attachment was named\u00a0COMPROVATIVO-JUNHO_OJLWnObxFOyTZkx_01-06-2026_104.zip<\/code>. <\/p>\n

Inside was a roughly 1.3MB HTML document padded with meaningless code and random strings, a tactic intended to make the file harder to inspect and less likely to match common detection signatures.<\/a><\/p>\n

\n
\"Phishing
Phishing email (Source \u2013 Acronis)<\/figcaption><\/figure>\n<\/div>\n

When opened, the HTML file displays a fake SAPO Transfer page that imitates a trusted Portuguese online service. <\/p>\n

The visual trick is meant to reassure victims while hidden JavaScript retrieves the next malware stage in the background.\u00a0<\/p>\n

\n
\"Fake
Fake SAPO file transfer page (Source \u2013 Acronis)<\/figcaption><\/figure>\n<\/div>\n

The downloaded JavaScript is inserted into the page and executed without obvious warning signs. <\/p>\n

This layered process shows why organizations should treat unexpected attachments carefully, especially messages that create pressure around invoices, receipts, and financial confirmations.<\/a><\/p>\n

The operators then deploy VBS files with names that continue the payment-document theme, including\u00a0Comprovativo_Junho_15-06-2026-WjGAxGL.vbs<\/code>. <\/p>\n

Related threats have used similar attachment-based deception, as reported in coverage of\u00a0common phishing attack vectors<\/a>, where malicious files remain a common route into corporate networks.<\/a><\/a><\/p>\n

These VBS scripts are also padded with junk data. One analyzed file was about 7MB, despite containing only around 22KB of useful code, demonstrating how file size inflation can conceal malicious behavior while complicating automated and manual review.<\/a><\/p>\n

750MB RAT Payload<\/strong><\/h2>\n

The final VBS component performs victim checks, gathers system information, and contacts command-and-control infrastructure for the next payload. It can create scheduled tasks, remove competing VBS files from the temporary folder, and generate a unique identifier from system details.<\/a><\/p>\n

The malware downloads a DLL into a timestamp-named folder under the user\u2019s AppData directory. It uses HTTP range requests to retrieve the file in 10MB pieces, then rebuilds it locally before scheduling execution through\u00a0rundll32<\/code>.<\/a><\/p>\n

Figure 7: Download of RAT component<\/strong><\/p>\n

The final DLL is around 750MB, but its size does not reflect genuine complexity. Researchers attribute much of it to junk padding, a long-used Lampion tactic that makes the payload harder to scan, transfer, and analyze.<\/a><\/p>\n

Once launched, the DLL uses an exported function named\u00a0jangadeiro<\/code>\u00a0and acts as the primary remote access trojan. <\/p>\n

It can give attackers access to the compromised system and support data theft, creating risk for both individuals and organizations.<\/a><\/p>\n

This campaign also fits a wider pattern of malware targeting European banking users through localized lures. Recent reporting on\u00a0Ousaban phishing PDF attacks<\/a>\u00a0shows that attackers are still combining fake financial documents with scripts and staged payloads to reach victims in Portugal and Spain.<\/a><\/p>\n

Defenders should investigate unusually large DLL files in AppData, especially those stored in timestamp-named directories. <\/p>\n

They should also review scheduled tasks that use\u00a0cmd \/c move<\/code>,\u00a0rundll32<\/code>, or VBS files in temporary folders, and inspect suspicious outbound connections linked to payment-themed attachments.<\/a><\/p>\n

Teams should verify unexpected receipts with the sender through a separate trusted channel before opening them. <\/p>\n

Using attachment scanning and sandboxing can help, but analysts should remember that geofencing and victim checks may prevent a malicious file from showing its full behavior during a single test, as discussed in guidance on\u00a0email virus sandbox checks<\/a>.<\/a><\/a><\/p>\n

Indicators of Compromise (IoCs):-<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Type<\/th>\nIndicator<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
SHA-256<\/td>\n87efeada5fe39a94cefc6151fd84af223d0e0e2b070daec606274481ed87b87b<\/code><\/td>\nPhishing email hash<\/td>\n<\/tr>\n
SHA-256<\/td>\nab46f7c4d3f717bb1e61d2f236917976d2a85be6958ae099fee79ea6e9031e37b<\/code><\/td>\nZIP attachment hash<\/td>\n<\/tr>\n
SHA-256<\/td>\n1c101bd1ba134ffbea61f9fac2b7c8fbd13ca113a37944abdc131ef86da92acc<\/code><\/td>\nHTML file hash<\/td>\n<\/tr>\n
SHA-256<\/td>\n6618bb692fb3f5d7959f8db1fedaaac5e8a36fb901397a008aa2b88874448fd<\/code><\/td>\nSecond-stage VBS hash<\/td>\n<\/tr>\n
SHA-256<\/td>\n036c8f32012abdcb9a389ae9c284da89505e830bca74eb1aa9ea3794b067aab<\/code><\/td>\nFinal-stage VBS hash<\/td>\n<\/tr>\n
File name<\/td>\nCOMPROVATIVO-JUNHO_OJLWnObxFOyTZkx_01-06-2026_104.zip<\/code><\/td>\nMalicious ZIP attachment<\/td>\n<\/tr>\n
File name<\/td>\nComprovativo_Junho_15-06-2026-WjGAxGL.vbs<\/code><\/td>\nObserved second-stage VBS file<\/td>\n<\/tr>\n
File name<\/td>\nComprovativo_Maio_18-05-2026-pXiaBxQ.vbs<\/code><\/td>\nObserved second-stage VBS file<\/td>\n<\/tr>\n
Domain<\/td>\nauto-contabilistica.com<\/code><\/td>\nInvolved domain<\/td>\n<\/tr>\n
Domain<\/td>\nautoridade-contabilistica.org<\/code><\/td>\nInvolved domain<\/td>\n<\/tr>\n
Domain<\/td>\nautoridade-financeira.com<\/code><\/td>\nInvolved domain<\/td>\n<\/tr>\n
Domain<\/td>\nfat-contabislitaca.com<\/code><\/td>\nNext-stage downloader domain<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/fat-contabislitaca[.]com\/js\/1898.php<\/code><\/td>\nJavaScript downloader URL<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/18.218.184[.]201\/03_metal7342\/trapezio.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/18.222.100[.]142\/17_moldura8210\/regerem.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/18.222.100[.]142\/18_prateleira1967\/revigore.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.135.194[.]95\/09_nsabdo\/receado.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.139.85[.]102\/17_eudhfj\/regerem.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.139.85[.]102\/18_vdsyuh\/revigore.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.139.85[.]102\/20_fjegydk\/destravares.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.141.199[.]105\/13_ytdshe\/reimpresso.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.141.199[.]105\/15_rjhsymc\/unificador.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.141.199[.]105\/16_kdsgyue\/raquete.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.144.37[.]134\/01_sdneow\/fruais.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.144.37[.]134\/02_sjdhie\/reestruturado.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.144.37[.]134\/03_osneops\/trapezio.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.148.240[.]228\/05_dnwodu\/equivaler.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.148.240[.]228\/06_sndiwds\/galgassem.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.150.134[.]118\/05_papel6197\/equivaler.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/3.150.134[.]118\/06_couro8254\/galgassem.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n
C2 URL<\/td>\nhxxp:\/\/52.14.160[.]173\/10_algodao9148\/reunia.php<\/code><\/td>\nFinal-stage VBS C2<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em>[.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n

ALERT!: 20+ government sites delivered malware to businesses and citizens. <\/strong>See full attack research<\/strong><\/a> to check your own exposure.<\/strong><\/p>\n

The post Hackers Hide 750MB Lampion RAT Inside Fake Payment Receipt Emails<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Hackers Hide 750MB Lampion RAT Inside Fake Payment Receipt Emails Hackers are using fake payment receipt emails to deliver a 750MB Lampion remote access trojan to targets in Portugal. The campaign relies on familiar financial language, convincing business details, and oversized files designed to slow down analysis and evade security checks. The attack begins with […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-14538","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/14538"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=14538"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/14538\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=14538"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=14538"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=14538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}