Campaign record

Lampion via a Portuguese tax lure

Lampion banking malware delivered through a fake Portuguese tax-authority lure

Status as last assessed: Active
First seen: 2025-05-06
Last seen: 2025-05-06
Indicators: 55
Sources: 2
Targets: Windows

Tax authority impersonation
Lampion
Phishing email

Original research

Unit 42, Palo Alto Networks2025-05-06Vendor researchFirst account
Lampion Is Back With ClickFix Lures
Read the original ↗ at Unit 42, Palo Alto Networks
Microsoft Threat Intelligence2025-08-21Vendor research
Think before you Click(Fix): Analyzing the ClickFix social engineering technique
Read the original ↗ at Microsoft Threat Intelligence

This page summarises and structures that research; it is not a substitute for the original.

Researchers: if anything here misrepresents your work, email corrections@clickfixreport.com — we correct within 5 working days, no questions asked.

Summary

Unit 42 ties a burst of attacks on dozens of Portuguese organisations in government, finance and transport to the crew behind Lampion, a banking infostealer active since 2019. An emailed ZIP held an HTML file that pushed the recipient to a counterfeit tax-authority site, where a page asked them to paste a PowerShell line into the Run box, described in Portuguese as turning on file preview. That fetched an obfuscated VBScript, first of several stages split across separate processes, scheduled tasks and a startup .cmd, so no single process tree shows the whole chain. Stage three fingerprinted the host and posted an encoded victim identifier to rented cloud servers; stage four was a very large DLL loaded through rundll32. Microsoft later recorded the same activity in Switzerland, Luxembourg, France, Hungary and Mexico, still running that June. Neither account saw a payload land — the fetch was commented out.

Cross-vendor timeline

2 published accounts. Unit 42, Palo Alto Networks was first, on 2025-05-06. The most recent is Microsoft Threat Intelligence, 107 days later.

2025-05-06Unit 42, Palo Alto Networks
Lampion Is Back With ClickFix Lures
2025-08-21Microsoft Threat Intelligence+107 days
Think before you Click(Fix): Analyzing the ClickFix social engineering technique

Dates are the publishers’ own publication dates as recorded when we retrieved each article. Publication order is not attribution: a later account may be the more complete one.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

Execution mechanisms recorded for this campaign, with their frequency across the corpus
Mechanism	Across the corpus	ATT&CK
Windows Run dialog	23 of 4452%	T1204.004
PowerShell	19 of 4443%	T1059.001

Both of these mechanisms appear together in 12 of the 44 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

55 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

Indicators recorded for this campaign, shown defanged
Indicator	Type	Role	Assessment	First seen	Last seen	Report an error
domain, shown defanged for safety: autoridade-tributaria dot com	domain	Lure page	Attacker-controlled	—	—	Report an error in domain record 1af476ae-7376-4d9a-9976-b880d4e91c59
url, shown defanged for safety: hxxps colon slash slash inde-faturas dot com/54879878	url	Download URL	Not yet assessed	—	—	Report an error in url record 52487a30-9447-4f10-9d62-f1237a8ba6ce
domain, shown defanged for safety: inde-faturas dot com	domain	Payload host	Not yet assessed	—	—	Report an error in domain record 5ae0a222-5058-495c-bf9e-e5dc654fce5b
ip, shown defanged for safety: 16 dot 171 dot 23 dot 221	ip	Payload host	Not yet assessed	2025-05-06	2025-05-06	Report an error in ip record 195e4eb6-ded8-4dae-8272-72d52d5cce04
ip, shown defanged for safety: 3 dot 138 dot 123 dot 13	ip	Payload host	Not yet assessed	2025-05-06	2025-05-06	Report an error in ip record 54528faf-6678-4519-9307-5014774e8a61
ip, shown defanged for safety: 18 dot 116 dot 15 dot 129	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record edcab948-b757-46eb-903d-663ffed1e034
ip, shown defanged for safety: 18 dot 116 dot 28 dot 153	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 127a970d-eaf4-4736-9431-ae76c826ea97
ip, shown defanged for safety: 18 dot 116 dot 63 dot 61	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 71b89d98-f8cf-4f71-8857-250a356f6dde
ip, shown defanged for safety: 18 dot 117 dot 11 dot 70	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 77616d99-b774-4a6d-8297-91d8001a3cd9
ip, shown defanged for safety: 18 dot 117 dot 173 dot 119	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record e345666d-0a64-4389-b1bd-e13509ff7ffd
ip, shown defanged for safety: 18 dot 117 dot 71 dot 203	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 3d09168a-8f63-4d4e-9306-0fb86eea6581
ip, shown defanged for safety: 18 dot 118 dot 163 dot 100	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 98d9b3b8-4d7b-4438-a786-0f46b7d05266
ip, shown defanged for safety: 18 dot 191 dot 192 dot 110	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 39c67377-eb8d-44ec-ad37-175cd2134728
ip, shown defanged for safety: 18 dot 191 dot 240 dot 233	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 33e0c0ee-43e2-42fd-aba6-623547c2c102
ip, shown defanged for safety: 18 dot 216 dot 78 dot 94	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 2eb4cb0c-5ea6-425e-ab1a-b12be3dac03e
ip, shown defanged for safety: 18 dot 217 dot 122 dot 187	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 90c89873-fdc1-4e43-8f65-e450c5f40a49
ip, shown defanged for safety: 18 dot 217 dot 180 dot 185	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record b0e0c9ee-82e9-4aee-9be4-b7507ee7bdb2
ip, shown defanged for safety: 18 dot 220 dot 96 dot 58	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 21bfd5b4-0574-433e-a850-62915c19afba
ip, shown defanged for safety: 18 dot 221 dot 69 dot 167	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 55539485-7d04-4bc3-aa99-de100b6d2050
ip, shown defanged for safety: 18 dot 222 dot 97 dot 143	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 946ed276-e4fd-456f-aeec-e81fadee1aeb
ip, shown defanged for safety: 18 dot 224 dot 38 dot 123	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 7d2d42cf-c5b2-4b34-8d47-45029e2520af
ip, shown defanged for safety: 18 dot 226 dot 150 dot 56	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record ee6a0d28-732b-4d3a-898f-77cd78dde6d1
ip, shown defanged for safety: 3 dot 128 dot 34 dot 187	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record d6b7eb32-6e1e-41a0-a5ae-f0fff0998e2b
ip, shown defanged for safety: 3 dot 133 dot 113 dot 215	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 77d61c24-0473-4137-ab7a-dd8d69a4254f
ip, shown defanged for safety: 3 dot 133 dot 160 dot 140	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record fcf463bf-9a38-4bbe-8f5e-1660844ab74f
ip, shown defanged for safety: 3 dot 135 dot 200 dot 135	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record a2374871-e1cc-41c7-8028-542cb1338e19
ip, shown defanged for safety: 3 dot 135 dot 249 dot 199	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 51de0694-e5ef-4469-a206-9db11790dbd2
ip, shown defanged for safety: 3 dot 138 dot 32 dot 196	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record c4ac98d2-8efc-435e-9481-00ad6e674518
ip, shown defanged for safety: 3 dot 142 dot 200 dot 117	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 2d7f1398-6d02-4b3d-bab9-fe1c391e720b
ip, shown defanged for safety: 3 dot 142 dot 40 dot 36	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 28cbc7f6-61da-48cf-8912-034b8764302c
ip, shown defanged for safety: 3 dot 143 dot 24 dot 42	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record e8be6425-991d-45a1-b76b-95787d6d82ed
ip, shown defanged for safety: 3 dot 147 dot 127 dot 14	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record f3a7e94d-cd56-47c0-8f5e-afdf00191fbe
ip, shown defanged for safety: 3 dot 147 dot 86 dot 100	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 029ff02c-5c7c-4a32-997c-e2187e1bea27
ip, shown defanged for safety: 3 dot 15 dot 155 dot 141	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 3050becf-9124-454a-b2a3-fb52d1d445e0
ip, shown defanged for safety: 3 dot 15 dot 7 dot 241	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 73070b86-bfdd-458a-bf62-ec4000ed81b3
ip, shown defanged for safety: 3 dot 16 dot 76 dot 203	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record 105be7d4-90de-4db3-ad1b-d478de572b83
ip, shown defanged for safety: 3 dot 23 dot 103 dot 13	ip	Command and control	Shared infrastructure	2025-05-06	2025-05-06	Report an error in ip record 714be946-3d61-4284-93cc-4706a28842da
ip, shown defanged for safety: 3 dot 23 dot 105 dot 171	ip	Command and control	Shared infrastructure	—	—	Report an error in ip record f0bd2b3b-ec07-408c-8b2f-ed620145c117
ip, shown defanged for safety: 5 dot 8 dot 9 dot 77	ip	Command and control	Not yet assessed	2025-05-06	2025-05-06	Report an error in ip record f76c8276-5721-423a-87d1-c4c92a9bccb4
ip, shown defanged for safety: 83 dot 242 dot 96 dot 159	ip	Command and control	Not yet assessed	2025-05-06	2025-05-06	Report an error in ip record 74caa5df-e38b-4e6d-978c-8231e66a3980
url, shown defanged for safety: hxxp colon slash slash 18 dot 116 dot 63 dot 61/ifeellike dot php	url	Command and control	Shared infrastructure	—	—	Report an error in url record f3b83c73-0b09-4421-910f-d1dee100b4bd
url, shown defanged for safety: hxxp colon slash slash 18 dot 116 dot 63 dot 61/trogloditas dot php	url	Command and control	Shared infrastructure	—	—	Report an error in url record 1fb3f99b-e3cd-40e3-be93-2abed845fdbc
url, shown defanged for safety: hxxp colon slash slash 18 dot 216 dot 78 dot 94/aceitalo dot php	url	Command and control	Shared infrastructure	—	—	Report an error in url record 5f20f333-5709-4ccc-8b97-18b5b5d7eb44
url, shown defanged for safety: hxxp colon slash slash 18 dot 217 dot 122 dot 187/proposito dot php	url	Command and control	Shared infrastructure	—	—	Report an error in url record a906b0be-c457-42df-9fa5-5e5c42eb462d
url, shown defanged for safety: hxxp colon slash slash 18 dot 226 dot 150 dot 56/persistir dot php	url	Command and control	Shared infrastructure	—	—	Report an error in url record d3c35005-c045-4e9f-ac78-9e51243389ca
url, shown defanged for safety: hxxp colon slash slash 3 dot 135 dot 249 dot 199/prayfor dot php	url	Command and control	Shared infrastructure	—	—	Report an error in url record 2045a789-88de-4024-a473-60ed50234d17
url, shown defanged for safety: hxxp colon slash slash 3 dot 142 dot 40 dot 36/grow dot php	url	Command and control	Shared infrastructure	—	—	Report an error in url record b1147169-ea8d-4657-957c-7f1a307b6e98
url, shown defanged for safety: hxxp colon slash slash 3 dot 23 dot 103 dot 13/stick dot php	url	Command and control	Shared infrastructure	—	—	Report an error in url record 7e9310e9-1a1e-4f15-845a-16b00d77974b
sha256, shown defanged for safety: 1681c3b88ed315543ac1bf07d258d560cf2f85bfd26c10471d71700eaeb57fb3	sha256	Sample	Not yet assessed	—	—	Report an error in sha256 record dcce4a1e-944a-4532-9554-bf0943dc3bc2
sha256, shown defanged for safety: 29b63fcf8e5f08fd12166507b3a85746e3ec685ae0620a124e64125ecd9ccf9b	sha256	Sample	Not yet assessed	—	—	Report an error in sha256 record e2801889-c0a2-455d-ac3d-f34a449ea0b5
sha256, shown defanged for safety: 334dfbaefbf7e6301d2385f95d861eb6dae9018c48fb298a2cbf5f364fbcdb2d	sha256	Sample	Not yet assessed	—	—	Report an error in sha256 record 0162ae7c-1abb-4f87-8696-5cf8582300b8
sha256, shown defanged for safety: 4aeb84dd71588a35084109ff5525c7bff2f30e0ed58ce139621b17f2374bdb35	sha256	Sample	Not yet assessed	—	—	Report an error in sha256 record b21c0781-6703-4071-be3a-96840dd4704d
sha256, shown defanged for safety: 58fe2a7d4435c9c24c98d33aff1110add4bf95add31558f51289a028ddafcc6e	sha256	Sample	Not yet assessed	—	—	Report an error in sha256 record 9b3825b5-8d5f-46c1-be30-eb9b78c60fbb
sha256, shown defanged for safety: bba48cf24bb9e6bdcbc79c2241f101e3dd4127ab450e3dbbe1b79fa738f06483	sha256	Sample	Not yet assessed	—	—	Report an error in sha256 record 7c65714b-08f1-41b7-b388-2fcbc9e8ad25
sha256, shown defanged for safety: ee4c8e4cce55bd40afa1fb0bc0eee3d7c23d0ebe2db48c2092e854f6ca1472ce	sha256	Sample	Not yet assessed	—	—	Report an error in sha256 record ce560ddc-e0ad-494d-bef8-000645834ba4

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.

Not on this record

This record does not yet carry any overlap with another campaign in this corpus or our own re-checks of these indicators. Each appears on this page as its own section once it exists; none of it is inferred.

Cite as

ClickFixReport, “Lampion via a Portuguese tax lure”, campaign ID 90794874, retrieved 2026-08-07, snapshot fb0eed7.

https://clickfixreport.com/campaigns/90794874/lampion-clickfix-phishing

Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.