A Six-Year-Old Brazilian Bank Fraud Tool Is Still Emptying Portuguese Accounts

Key points

• Lampion, a banking malware first spotted in late 2019, is still running active attacks against Portuguese organisations in 2025.
• Researchers at Acronis identified a new campaign in which criminals impersonate private Portuguese businesses, including an automotive documentation agency, to trick victims.
• Around 96.4% of recent Lampion attacks hit Portugal specifically, with a small number reaching Spain and England.
• Brazilian criminals deliberately target Portugal because shared language makes convincing fakes easy and cross-border policing slows enforcement.
• Risk management firm Marsh Risk found that cyberattacks became the number one business risk for Portuguese companies in 2026, the first time in twelve years cyber topped that list.

Some malware gets retired. Lampion just keeps cashing in.

First flagged around the 2019 holiday season, Lampion is a banking trojan, meaning software criminals install secretly on a victim's machine to steal online banking credentials. Built in Brazil, a country with one of the most active cybercrime scenes on the planet, it has been pointed almost exclusively at Portugal for six years. According to new research from Acronis, it is still running in a form that would look familiar to anyone who analysed it when it first appeared. We covered Brazilian threat infrastructure in July when attackers quietly took over more than 20 official .gov.br domains to push malware; Lampion is a different operation but the same geography of intent.

How does the attack actually work?

Victims get a convincing fake email. That is where every Lampion attack has started, and that has not changed.

In the campaigns Acronis observed, criminals sent emails pretending to be Portuguese businesses, including an automotive documentation agency. Messages warned recipients about a pending financial or administrative issue and arrived with real brand logos, a confidentiality notice and a fake email signature with social media links. Everything looked legitimate.

Clicking the attachment downloads a zip file, a compressed folder of files. Opening it triggers a webpage that mimics SAPO, Portugal's best-known internet portal, to look normal to the victim. Behind that distraction, the software installs itself quietly, sets up a scheduled task so it restarts automatically, and calls home to a remote server controlled by the criminals.

The result is code sitting on the victim's machine that watches for visits to Portuguese banking websites. When the victim logs in, Lampion throws a fake overlay, a transparent fake screen, over the real banking page and captures whatever the victim types: usernames, passwords, account details.

Why does Portugal keep getting hit?

Shared language, weaker cross-border policing. Simple as that.

Portugal is the largest Portuguese-speaking country in Europe. Brazilian criminals can write convincing phishing emails without a translator, and their fake documents look native because they are. Acronis threat intelligence lead Santiago Pontrioli, speaking at a "You sh0t the Sheriff" conference in São Paulo, recalls what he heard directly from Brazilian threat actors: they target victims outside Brazil so local police cannot easily act. Involve two countries and you need Interpol, and Interpol takes time.

The strategy works. Marsh Risk found that cyberattacks became the single biggest risk reported by Portuguese companies in 2026, beating out political instability for the first time in the survey's twelve-year history.

Acronis senior researcher Jozsef Gegeny put it plainly, telling Dark Reading that attackers keep using the same techniques because those techniques keep generating returns, leaving little incentive to redesign something profitable. His view is that Lampion's longevity shows some attack models are remarkably resilient without needing groundbreaking innovation, only incremental adaptation.

The failure mode here is not a sophisticated zero-day, meaning a secret software flaw the maker hasn't patched. It's a convincing email and a person who clicks it.

Should you worry?

If you or someone you know receives an unexpected email from a Portuguese government body or business asking you to open an attachment or review a receipt for a transaction you don't remember, treat it as suspect. Call the organisation directly on a number you find yourself, not one in the email.

An email that arrives with urgency, familiar branding and an attachment you weren't expecting is the attack. Not any single element alone: the combination is what Lampion depends on. Six years of success suggests that combination is still working fine.