A highly advanced banking malware, Lampion, has reemerged with a refined strategy, leveraging deceptive ClickFix bait to extract critical banking information from unaware users.
Originally discovered in late 2019, this malware has undergone significant updates to improve its ability to infiltrate financial systems, targeting a growing number of European banking institutions.
The most recent wave of attacks underscores the operators’ ongoing efforts to enhance their social engineering tactics, increasing the effectiveness of their campaigns.
This new wave of Lampion employs fake emails masquerading as legitimate software update notifications, specifically promoting a non-existent tool called “ClickFix” that supposedly resolves browser compatibility issues.
These phishing messages include malicious attachments or links that prompt users to download what looks like a browser repair application, only to install the Lampion malware instead.
Once activated, the malware silently begins collecting sensitive banking information, including login credentials, credit card details, and other financial data from the infected machines.
Security researchers from Palo Alto Networks identified this latest variant after noticing a significant rise in infection attempts across various countries.
Their investigation revealed advanced techniques used by the malware to evade detection by conventional security systems, while maintaining ongoing access to the compromised devices.
The campaign primarily targets banking customers in Portugal, Spain, and other European countries, using region-specific lures in multiple languages to maximize its reach.
Consequences of the Attack
The financial toll of this operation has been significant, with many victims reporting unauthorized transactions after their systems were compromised.
In response, affected banking institutions have been forced to tighten security protocols and collaborate with cybersecurity experts to contain the threat.
This widespread attack serves as a stark reminder of the persistent evolution of financial malware, posing an ongoing risk to both individuals and financial organizations alike.
Lampion’s ClickFix Infection Process (Source: Palo Alto Networks)
The infection process begins when a victim unknowingly installs the fraudulent ClickFix tool, which runs an encrypted VBScript. This script modifies system registries to establish persistence within the infected machine.
Below is a simplified overview of how the script works:
sql
Set WshShell = CreateObject(“WScript.Shell”)
strRegPath = “HKCU\Software\Microsoft\Windows\CurrentVersion\Run\”
WshShell.RegWrite strRegPath & “ClickFixUpdate”, “wscript.exe //B ” & “””” & CreateObject(“WScript.Shell”).ExpandEnvironmentStrings(“%TEMP%”) & “\updater.vbs” & “”””, “REG_SZ”
This initial phase sets the stage by ensuring the malware’s continued presence on the system and prepares for the next phase by downloading additional malicious components from a remote command and control server.
Once the Lampion payload is successfully retrieved, the malware employs sophisticated techniques to monitor and intercept banking transactions, all while maintaining a stealthy profile to evade detection.
