Attackers are combining multiple evasion tactics to deliver Business Email Compromise (BEC) phishing attacks with a high degree of success. This campaign, dubbed “The TFF Trap,” has been observed by researchers at Fortinet since late March and involves the use of disguised font files, Lua interpreters, and in-memory execution to bypass endpoint defenses.
At its core, this attack relies on social engineering, where attackers impersonate well-known companies such as FedEx to trick victims into opening email attachments that contain malicious JavaScript. This code is heavily obfuscated, making it difficult for security tools to detect. Once executed, the malware establishes persistence on the victim’s system and launches a second-stage loader, which deploys a legitimate LuaJIT or AutoIt interpreter alongside an encrypted file disguised as a TrueType Font (.ttf) file.
The interpreter then decrypts and executes the malicious code directly in memory, where it performs additional anti-analysis checks, unhooks Windows APIs that may be monitored by endpoint security tools, and reflectively loads the final payload without writing it to disk. This combination of obfuscation techniques makes it challenging for even advanced threat detection systems to identify the malware.
The attackers are targeting Microsoft Windows systems with the ultimate goal of gaining control or using stolen data for follow-on attacks via one of several deployed malware types. Initial engagement comes through business email compromise (BEC) by using messages that mimic business cooperation and involve a company familiar to the victim. The obfuscation layers, Lua loader disguised as a font file, and fileless execution chain all exist to survive detection after the human decision has already been made.
This campaign highlights the ongoing evolution of threat actors who are constantly adapting their tactics to evade traditional defenses. As Shane Barney, chief information security officer at Keeper Security, notes: “The obfuscation layers, the Lua loader disguised as a font file, the fileless execution chain — all of it exists to survive detection after that human decision has already been made.” Organizations should keep this in mind and be vigilant when dealing with phishing attacks.
In practical terms, this means that users must remain cautious when receiving emails from familiar companies, especially those related to shipping and logistics. It’s essential to verify the authenticity of these messages before taking any action. Additionally, security teams should consider implementing additional measures such as behavioral-based detection tools and memory-resident inspection to detect and prevent in-memory execution of malicious code.
Ultimately, this campaign serves as a reminder that threat actors will continue to evolve their tactics to evade detection. As such, it’s crucial for organizations to stay informed about the latest threats and adapt their security posture accordingly. By doing so, they can minimize the risk of falling victim to these types of attacks.
Source: Dark Reading — 2026-07-20