Threats Tagged 'ttf disguise'

A global phishing campaign since March 2026 uses fileless techniques and low-detection Lua-based loaders disguised as TrueType Font (.ttf) files to deploy malware such as Agent Tesla, Remcos, XWorm, and Best Private LOGGER. The campaign employs obfuscated JavaScript to execute AutoIt or LuaJIT interpreters with advanced anti-analysis methods including custom ROT ciphers, decoy memory allocation, and reflective in-memory shellcode execution. The threat actors impersonate well-known companies to lure victims into opening malicious archives. Over time, the campaign has evolved to include API unhooking and sophisticated debugging countermeasures, ultimately infecting victims with Remote Access Trojans and infostealers that enable full system compromise and data theft.