Global Phishing Campaign Uses Lua Loader Disguised as TrueType Font Files

Since late March 2026, a large-scale phishing campaign has been observed utilizing disguised TrueType Font (.ttf) files to deliver Lua-based loaders and various malware, including Agent Tesla and Remcos. The attackers impersonate reputable companies to lure victims into opening malicious archives attached to phishing emails. The JavaScript files within these archives are heavily obfuscated, employing techniques like string array mapping and control flow flattening to evade detection. Once executed, the scripts establish persistence by copying themselves to the %PUBLIC%\Libraries folder and setting up scheduled tasks. The final payloads include remote access trojans (RATs) and infostealers, with the attack's design allowing for in-memory execution, leaving minimal traces on disk. The campaign has been confirmed by Fortinet's FortiGuard Labs, highlighting the need for improved detection methods that focus on file behavior rather than extensions. The impact is significant, affecting any organization using Microsoft Windows.

Key Points: • Attackers use .ttf files to disguise Lua loaders for malware delivery. • The campaign has been active since late March 2026, targeting Windows systems. • Malware includes Agent Tesla, Remcos, XWorm, and Best Private LOGGER.