TTF Trap Campaign Hides a Low-Detection Lua Loader Inside Fake TrueType Font Files
Do Son 
A global phishing campaign hides a low-detection Lua loader inside fake .ttf font files to drop Remcos, XWorm, Agent Tesla, and a Snake Keylogger.
#LuaLoader #TTFTrap #Phishing #FortiGuard #Remcos #AgentTesla #Malware #InfoSec
https://securityonline.info/ttf-trap-lua-loader
At a glance
| Malware family | Lua/AutoIt loader (“TTF Trap”) delivering Remcos, Agent Tesla, XWorm, and Best Private LOGGER |
| Threat actor | Unattributed. FortiGuard Labs names no group. |
| Target / victims | Any Windows organization; global reach via business-themed phishing |
| Delivery vector | Phishing emails with ZIP/RAR archives or download links |
| Key capabilities | Fileless execution, heavy obfuscation, anti-analysis, in-memory shellcode |
| Source | FortiGuard Labs (Fortinet), July 16, 2026 |
TL;DR
FortiGuard Labs disclosed a global phishing campaign it calls “TTF Trap” on July 16, 2026. The attack hides a low-detection Lua loader inside a file that looks like a TrueType Font. That loader then drops common RATs and infostealers on Windows machines.
Why it matters
The trick is the disguise. A .ttf file looks like a harmless font, so it slips past a quick glance. Fortinet rates the threat High and warns that any Windows organization could be hit.
Scale adds weight. Fortinet reports the campaigns run since late March 2026, with loader code traced back to October 2025. As the team puts it, the operation causes “a significant global impact.”
Delivery
The campaign starts with a phishing email. Some carry a malicious ZIP or RAR archive. Others link out to one.
The lures lean on trust and urgency. Attackers impersonate known brands and use payment or shipping themes. That pressure pushes the target to open the attachment.
Infection chain
Inside the archive sits an obfuscated JavaScript file. It hides in heavy junk code and uses control-flow flattening to defeat analysis. Once run, it checks a few conditions, copies itself to a Public folder, and sets a Scheduled Task for persistence.
The script then drops the next stage. It reverses strings, strips junk delimiters, and decodes from Base64 to rebuild the files. Those files include an interpreter, either LuaJIT or AutoIt, plus the disguised script.
The disguised Lua loader
Here lies the core trick. The dropped .ttf file is not a font. Per Fortinet, “the dropped .ttf file is actually a disguised Lua script.” The interpreter reads it, decrypts it, and runs the next stage.
The Lua loader peels back several layers. It reverses a hardcoded string, swaps symbols, and decodes Base64. A custom rotation cipher follows. This design keeps detection rates low.
Anti-analysis tricks
The newest samples fight back hard. They allocate decoy memory filled with fake driver strings. They also unhook APIs and neutralize software and hardware breakpoints.
Execution stays hidden too. The loader splits shellcode into locked pages, then decrypts each one on demand through an exception handler. That keeps the payload out of plain view.
Command-and-control and payloads
The final payload wraps in Donut shellcode. A reflective loader then maps it straight into memory, so little touches disk. This fileless step is what makes the phishing campaign hard to catch.
The dropped malware varies by attack. Fortinet observed Remcos, Agent Tesla, XWorm, and Snake Keylogger variants. One variant, “Best Private LOGGER,” matches Snake Keylogger’s collection code. Each grants remote control and steals credentials.
Attribution
No attribution exists yet. FortiGuard Labs names no actor and no group. The payloads are commodity tools sold widely, which fits a financially driven, opportunistic operation rather than one known crew.
Detection and defense guidance
Start at the inbox. Filter for archives arriving with payment or shipping lures, and treat a .ttf inside an archive as a red flag. A font file has no reason to run through an interpreter.
Behavioral signals help most. Watch for JavaScript spawning WScript.Shell, new Scheduled Tasks, and files landing in the Public Libraries folder. Fortinet published hashes and C2 indicators, so defenders can hunt for this Lua loader today.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
