Lampion RAT DLL (rundll32/jangadeiro) Process Access into Browser Processes for Overlay Credential Theft

Luís Marques@remotecodeexecution

•updated Jul 23, 2026•1•0•3

This rule detects rundll32.exe attempting to access the memory of common web browsers (Chrome, Edge, Firefox, IE). The activity is identified by the presence of 'jangadeiro' in the command line of the rundll32 process, which is a known behavior of the Lampion banking trojan used for browser overlay credential theft.