Our new blog post provides details on their infection chain, with changes we've seen in the past year of the campaign. The blog post contains a lot of IoCs to help identify this threat, but if you want some YARA rules or need more information about it, feel free to message me!

From Brazil with Love: New Tactics from Lampion | Bitsight In this blog post, we’ll be describing a long-running spam campaign from a Brazilian group known for using the Lampion banking trojan, active since at least 2019.

It's over 9000! The number of infected IPs in Portugal in 2025... This group has been targeting Portuguese speakers with a banking trojan since at least 2019, and they just don't stop spamming.
www.bitsight.com/blog/brazil-...