The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

Since late March 2026, a large-scale phishing campaign has been observed distributing multiple malware families (Agent Tesla, Remcos, XWorm, Best Private LOGGER) via fileless techniques using Lua-based loaders with low detection rates. The loaders are delivered in obfuscated JavaScript archives disguised as TrueType Font (.ttf) files. These loaders utilize AutoIt or LuaJIT interpreters and implement advanced anti-analysis techniques such as custom ROT ciphers, decoy memory allocation, Donut shellcode generation for reflective in-memory execution, API unhooking, and debugging countermeasures. The campaign impersonates reputable companies with business cooperation-themed lures to entice victims. Over time, the campaign has increased in complexity from October 2025 to June 2026. The final payloads are Remote Access Trojans and infostealers that provide attackers with full system control and enable extensive data theft.

Successful exploitation results in the deployment of Remote Access Trojans and infostealers on victim systems, allowing attackers to gain full control over infected machines and exfiltrate sensitive data. The use of fileless execution and sophisticated evasion techniques reduces detection likelihood, increasing the risk of prolonged undetected compromise.

No specific patch or vendor remediation is available as this is a phishing campaign leveraging social engineering and fileless malware loaders. Defenders should focus on user awareness training to recognize phishing lures, implement email filtering to block malicious attachments, and deploy endpoint detection solutions capable of identifying fileless and script-based threats. Monitoring for indicators of compromise related to the described malware families and Lua-based loaders is recommended. Since no official fix exists, prevention relies on layered security controls and user vigilance.