Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise NEWSLETTER SIGN-UP Cybersecurity Topics World The Edge DR Technology Events Resources ENDPOINT SECURITY THREAT INTELLIGENCE REMOTE WORKFORCE VULNERABILITIES & THREATS NEWS Attackers Combo Up Evasion Tactics for BEC Phishing "The TFF Trap" uses fileless techniques and loaders with low detection rates to deploy various RATs and stealers, including Agent Tesla, Remcos, XWorm, and Best Private Logger. Elizabeth Montalbano,Contributing Writer July 20, 2026 4 Min Read SOURCE: RONSTIK VIA ALAMY STOCK PHOTO Attackers are impersonating well-known companies to drop various remote access Trojans (RATs) and infostealers in a wide-scale phishing campaign designed for maximum evasion. The campaign highlights how threat actors continue to evolve beyond traditional executable-based attacks, using a combination of disguised font files, Lua interpreters, and in-memory execution to bypass endpoint defenses. Researchers at Fortinet since late March have observed the campaign, dubbed "The TFF Trap," which uses a combination of fileless techniques and Lua-based loaders with low detection rates to deploy various malware families, including Agent Tesla, Remcos, XWorm, and Best Private Logger, according to a report published last week. The name comes from attackers' use of a TrueType Font (.ttf) file to hide the AutoIT/Lua loader used to deliver malware. LOADING... "In these campaigns, the dropped executable serves as an interpreter, while the core loader script is disguised as a .ttf extension," Fortinet threat researchers Yurren Wan wrote in the report. "This disguised loader decrypts, loads, and executes the subsequent stage, which ultimately deploys the malware." Related:Weak Security Continues to Fuel Russian Cyberattacks Attackers specifically are targeting Microsoft Windows systems with the ultimate goal of gaining control of them or using stolen data for follow-on attacks via one of the several malware types deployed in the attack. Initial engagement with victims comes through business email compromise (BEC) by using messages that use the guise of business cooperation and a company familiar to the victim to launch the attack. An Impersonation Attack Designed for Evasion Attackers have built evasion into each stage of the attack, combining several well-known techniques that are rarely seen together at scale, according to Fortinet. By abusing legitimate scripting environments, loading payloads directly into memory, and disguising malicious content as benign font files, the attackers significantly reduce opportunities for signature-based detection and static analysis and thus increase their chances at success, according to Wan. LOADING... Still, all of this added evasion begins the same way any phishing attack starts, which is when "someone opens an email from what looks like a trusted company and acts on it," observes Shane Barney, chief information security officer (CISO) at cybersecurity software provider Keeper Security. In this case, attackers impersonate FedEx and other shipping and logistics companies with which someone would engage without question. "The obfuscation layers, the Lua loader disguised as a font file, the fileless execution chain — all of it exists to survive detection after that human decision has already been made, and organizations would do well to keep that in their sightline," he tells Dark Reading. Related:'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat The attack chain is set in motion when a would-be victim executes an email attachment that comes in the form of a heavily obfuscated JavaScript that, when executed, establishes persistence on the victim's system and launches a second-stage loader. Instead of dropping a conventional executable, however, the malware deploys a legitimate LuaJIT or AutoIt interpreter alongside a file disguised as .ttf that actually contains encrypted Lua bytecode. The interpreter then decrypts and executes the malicious code directly in memory, where it performs additional anti-analysis checks, unhooks Windows APIs that may be monitored by endpoint security tools, and reflectively loads the final payload without writing it to disk, according to Fortinet. In this way, obfuscation confuses static analysis, while the abuse of trusted interpreters helps blend malicious activity with legitimate processes, according to Fortinet. Later in the attack, the fake font file conceals the payload from extension-based inspection, and memory-resident execution minimizes forensic artifacts and reduces the likelihood that antivirus (AV) or even some behavior security tools will detect the malicious activity, according to Wan. Related:Rokarolla Android Trojan Levels Up to Full Device Control, Persistence Securing the Business Against Advanced Cyber Tactics Phishing remains a reliable attack vector for threat actors, which means organizations need to assume that their employees will likely at some point fall prey to advanced tactics like the ones The TFF Trap attackers are using. Once that happens, the key to keeping systems secure will be to lock down attack access downstream, experts say. In this case, identity and access controls can carry the weight of an attack by limiting what an attacker can access once initial access is achieved, Barney notes. "Limiting what any given set of credentials can reach, enforcing least privilege, requiring re-authentication for sensitive systems, and monitoring for anomalous session behavior will not stop every phishing email from landing, but they significantly constrain what an attacker can accomplish after one succeeds," he says. To avoid even initial compromise by The TFF Trap, Fortinet included a comprehensive set of indicators of compromise (IoCs) for defenders to track, including URLs, Jscripts, Lua scripts, and command-and-control (C2) network addresses. Organizations also can try to get their employees into the habit of "interrogating urgency in email, particularly when a message arrives dressed as a routine business request from a recognizable name," Barney adds. "Any unexpected outreach of that kind should be treated as unverified until confirmed through a separate channel," he says. About the Author Elizabeth Montalbano Contributing Writer Elizabeth Montalbano is freelance writer, editor, and journalist with 30 years of professional experience and a master's degree from Arizona State University. Her areas of expertise include enterprise technology, cybersecurity, business, and culture. During her long career, Elizabeth has lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City. She specializes in news coverage and analysis, using her years of experience to look at the current state of cybersecurity with a critical gaze. She currently resides in a village on the southwest coast of Portugal, where in her free time she enjoys surfing, hiking with her dogs, growing plants, and playing and performing as a singer and musician. Want more Dark Reading stories in your Google search results? ADD US NOW More Insights Industry Reports The State of Cloud Security: The Latest Challenges How Organizations Are Managing Incident Response How Enterprises Are Developing Secure Applications Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy Essential News & Insights from Black Hat USA 2025 Access More Research Webinars 0-Day to 10x Discovery: Security at the Speed of Mythos When AI Becomes an Insider: Rethinking Risk in Critical Infrastructure Governing the Agent; Identity Security in the Age of Autonomous AI Securing the AI Era: Shadow AI, AI Agents, and Why AI Detection and Response Changes Everything Practical Zero Trust Implementation on a Budget in the Age of Mythos More Webinars You May Also Like ENDPOINT SECURITY Bug in Google's Gemini AI Panel Opens Door to Hijacking by Elizabeth Montalbano MAR 02, 2026 ENDPOINT SECURITY Swipe, Plug-in, Pwned: Researchers Find New Ways to Hack Vehicles by Robert Lemos JAN 23, 2026 ENDPOINT SECURITY 2 Separate Campaigns Probe Corporate LLMs for Secrets by Elizabeth Montalbano JAN 12, 2026 ENDPOINT SECURITY Pro-Russian Hackers Use Linux VMs to Hide in Windows by Alexander Culafi NOV 04, 2025 Editor's Choice VULNERABILITIES & THREATS Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes byJai Vijayan JUL 14, 2026 5 MIN READ PERIMETER 6 GHz Wi-Fi Flaws Could Disrupt Critical Systems byAlexander Culafi JUL 14, 2026 4 MIN READ CYBERSECURITY OPERATIONS 'Yellow Teams' Are Defining the Future of AI Security byNate Nelson JUL 13, 2026 6 MIN READ Want more Dark Reading stories in your Google search results? Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. SUBSCRIBE LOADING... AUG 1-6 | MANDALAY BAY, LAS VEGAS USE CODE: DARKREADING & SAVE $200 ON A BRIEFINGS PASS OR $100 ON A BUSINESS PASS The premier cybersecurity event returns. GET YOUR PASS Discover More Black Hat Omdia Working With Us About Us Meet the Editors Advertise Reprints Join Us NEWSLETTER SIGN-UP Follow Us Copyright © 2026 TechTarget, Inc. d/b/a Informa TechTarget. This website is owned and operated by Informa TechTarget, part of a global network that informs, influences and connects the world’s technology buyers and sellers. All copyright resides with them. Informa PLC’s registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. TechTarget, Inc.’s registered office is 275 Grove St. Newton, MA 02466. Home| Cookie Policy| Privacy| Terms of Use Your Privacy Choices