Attackers have concocted a sophisticated phishing campaign designed to evade detection by leveraging a combination of fileless techniques and loaders with low detection rates. Dubbed “The TFF Trap” by researchers at Fortinet, this campaign has been observed since late March and has already seen widespread use in targeting Microsoft Windows systems.
At its core, the attack relies on business email compromise (BEC) tactics to trick victims into opening a malicious email attachment that contains heavily obfuscated JavaScript. Once executed, this script establishes persistence on the victim’s system and launches a second-stage loader, which is disguised as a TrueType Font (.ttf) file. In reality, however, this “font” file contains encrypted Lua bytecode, which is then decrypted and executed directly in memory by a legitimate LuaJIT or AutoIt interpreter.
This clever use of legitimate scripting environments and in-memory execution allows the attackers to significantly reduce their digital footprint, making it more challenging for endpoint security tools to detect. As Fortinet’s threat researchers point out, the abuse of trusted interpreters helps blend malicious activity with legitimate processes, while the obfuscation layers and fileless execution chain further complicate static analysis.
The ultimate goal of this campaign is to deploy various malware families, including Agent Tesla, Remcos, XWorm, and Best Private Logger. These malware types are designed for maximum impact, allowing attackers to gain control of victim systems or steal sensitive data that can be used in follow-on attacks. The researchers note that the use of multiple evasion techniques at scale is a rare occurrence, indicating that the attackers have put significant effort into developing this campaign.
Shane Barney, chief information security officer (CISO) at Keeper Security, observes that while this attack starts with a phishing email, it’s the subsequent layers of obfuscation and evasion that allow it to survive detection. “The obfuscation layers, the Lua loader disguised as a font file, the fileless execution chain – all of it exists to survive detection after that human decision has already been made,” he says.
This campaign serves as a stark reminder that threat actors continue to evolve their tactics and techniques to evade detection by security tools. As organizations strive to stay ahead of these threats, they must remain vigilant about the importance of employee education and awareness in preventing phishing attacks from ever taking hold. By keeping this human element at the forefront of their defenses, organizations can significantly reduce the risk of falling victim to such sophisticated campaigns.
In light of this campaign, it’s essential for users to be cautious when opening email attachments, especially those that seem suspicious or come from unfamiliar senders. Employing robust endpoint security measures and regularly updating antivirus software can also help mitigate the risk of infection. Moreover, organizations should consider implementing additional security controls, such as behavior-based detection tools, to monitor for unusual activity on their networks. By taking these proactive steps, users can better protect themselves against the evolving threats posed by sophisticated attackers like those behind “The TFF Trap”.
Source: Dark Reading — 2026-07-20