The TTF Trap: Global Phishing Campaign Delivers Lua-Based Loader for Agent Tesla, Remcos RAT, XWorm
The TTF Trap (TL-2026-1418), also tracked as TTF Trap, is a high-severity malware campaign, first published 2026-07-16. It has no confirmed attribution, affects Microsoft Windows (all supported desktop/server versions), maps to 42 MITRE ATT&CK techniques (T1010, T1012, T1016), and is covered by 9 detection rules and 50 indicators of compromise.
Key facts for TL-2026-1418
- Threat ID
- TL-2026-1418
- Also known as
- TTF Trap, The TTF Trap Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-16
- Last reviewed
- 2026-07-16
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cross-sector, businessservices
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 50
Malware and tooling in The TTF Trap
Malware and tooling: 404 Keylogger, Agent Tesla, Remcos, XWorm, Donut - S0695
Fortinet reports a large-scale, ongoing phishing campaign (tracked activity spanning October 2025 through June 2026, actively distributed since late March 2026) that disguises a Lua-based loader as .ttf font files. Multi-layered obfuscation (junk-code JScript, Donut shellcode, Vectored Exception Handler-based segmented encryption) deploys Agent Tesla, Remcos RAT, XWorm, and a Snake Keylogger variant ('Best Private LOGGER') against Windows targets worldwide.
How The TTF Trap works
The 'TTF Trap' campaign, documented by Fortinet's threat research team, is a global, ongoing phishing operation active since at least October 2025 (loader development) with widespread distribution beginning late March 2026 and continuing through June 2026. Threat actors impersonate reputable companies using business-cooperation lures, sending malicious archive attachments or download links via email and via Discord CDN-hosted attachments.
The infection chain begins with a JScript dropper obfuscated via string-array mapping, control-flow flattening, and anti-tampering/anti-analysis checks. The script copies itself to %PUBLIC%\Libraries and establishes persistence via a Windows Scheduled Task, re-executing only when a companion 'YESSSSSSSS' variable and the absence of next-stage files indicate the chain has not yet completed.
The dropper stages a file disguised with a legitimate .ttf (TrueType Font) extension that in reality bundles a Lua or AutoIt interpreter executable, a loader script, and base64/ROT-obfuscated encoded payload data — a masquerading technique (T1036.005) intended to slip past extension-based filtering and analyst triage. The Lua loader variant decrypts its payload through a three-step process: string reversal with symbol substitution (~→A, @→B, #→C, :→D, &→a, *→b, >→c, <→d), base64 decoding, and a custom rotation cipher where the rotation value is computed as 94 − first_byte − 128. An alternative AutoIt loader path performs equivalent functionality using obfuscated AutoIt scripts with string encryption, launching C:\Windows\Syswow64\colorcpl.exe as a suspended process and injecting into it via ntdll.dll process-hollowing primitives, backed by oversized memory allocations intended to evade heap-based sandbox heuristics.
Both loader paths converge on execution of Donut-generated shellcode. The Lua loader applies extensive anti-analysis tradecraft before that point: decoy memory allocations filled with suspicious strings and random data to mislead memory scanners, a custom PatchDonut64Header routine that masks Donut's distinctive shellcode signature bytes with a mask value (144, 204, plus randomized uppercase bytes), repeated in-memory XOR encryption/decryption cycles, memory page-guard tricks, and (in the June 2026 variant) active API-unhooking and software/hardware breakpoint neutralization aimed at defeating EDR hooks and debuggers. The most distinctive technique is the use of a Vectored Exception Handler (VEH) to decrypt the shellcode in page-guarded segments only on access — each segment is decrypted on demand when a guard-page access violation fires the VEH, and re-encrypted/discarded afterward, so a full plaintext copy of the shellcode is never resident in memory at once.
Once triggered, the Donut shellcode's built-in reflective loader maps and executes the final payload directly in memory, achieving a fileless final stage. Observed final payloads are Agent Tesla (.NET-based credential-stealing RAT/keylogger), Remcos RAT (commercial-grade surveillance/remote-access trojan marketed by Breaking Security and widely abused by criminal actors), XWorm (feature-rich commodity RAT with ransomware/DDoS plugin capability), and a Snake Keylogger variant tracked by Fortinet as 'Best Private LOGGER' — a modified-signature build sharing collection modules and coding style with the Snake VIP Keylogger builder, functioning as an infostealer/keylogger.
Command-and-control infrastructure spans dedicated IP:port pairs and dynamic-DNS/compromised-mail-subdomain fronting (DuckDNS entries and 'mail.' subdomains on business-cooperation-themed domains), consistent with commodity malware-as-a-service tooling rented or resold to multiple operators rather than a single dedicated actor group. No CVE is associated with this campaign — it is a social-engineering and loader-technique story, not a vulnerability exploit chain.
MITRE ATT&CK techniques used in TL-2026-1418
Discovery
T1010 Application Window Discovery; T1012 Query Registry; T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1574 Hijack Execution Flow
Exfiltration
T1048 Exfiltration Over Alternative Protocol
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Privilege Escalation
T1055 Process Injection; T1548 Abuse Elevation Control Mechanism
Credential Access
T1056 Input Capture; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1573 Encrypted Channel
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Collection
T1113 Screen Capture; T1115 Clipboard Data; T1123 Audio Capture; T1125 Video Capture; T1185 Browser Session Hijacking; T1560 Archive Collected Data
Impact
Initial Access
Affected products and versions in The TTF Trap
- Microsoft — Windows (all supported desktop/server versions)
Vulnerable versions: all currently supported Windows versions
Remediation for The TTF Trap
Immediate actions
- Block the identified C2 IPs (104.239.66.86:7004, 46.183.223.21:2404, 107.174.34.137:443) and domains (newremupdate.duckdns.org, mail.teamengineersgroup.com, mail.allportcargoservice.com, mail.trimnt.com, mail.taikei-rmc-co.biz) at perimeter firewall/proxy
- Block/alert on the known malicious Discord CDN attachment URL and similar attachments[.]* delivery paths from external mail gateways
- Hunt for files with .ttf extension containing PE/script content (magic-byte mismatch) rather than valid font table headers
- Hunt for Scheduled Tasks created under %PUBLIC%\Libraries or referencing recently dropped JScript files
- Search endpoint telemetry for colorcpl.exe spawned as a suspended process with anomalous child process injection
- Deploy/verify FortiGuard detections: PDF/Agent.A529!tr, JS/Formbook.PYN!tr, JS/Agent.UNU!tr, JS/Formbook.AK!tr, JS/Obfus.gen!tr, Data/Agent.DD19!tr, Data/Lua.9!tr, AutoIt/Autoit.OTS!tr, W64/Donut.E!tr, MSIL/AgentTesla.B!tr, W32/Rescomms.B!tr, MSIL/Agent.ECL!tr, MSIL/SnakeStealer.AVQ!tr.spy
Workarounds
- Disable Windows Script Host (wscript.exe/cscript.exe) execution for end users where not operationally required
- Block outbound traffic to dynamic DNS providers (e.g. duckdns.org) at the network egress layer for non-IT endpoints
Longer-term hardening
- Deploy EDR with in-memory/reflective-loading detection and VEH/exception-handler abuse monitoring, since this loader's core evasion relies on decrypting shellcode only inside VEH-triggered guard-page faults
- Enforce email attachment filtering that inspects true file type via content/magic bytes rather than trusting the .ttf/.js/.pdf extension shown to the user
- Restrict script host execution (wscript.exe/cscript.exe) for standard users via ASR rules or application control
- Monitor for unsigned Lua/AutoIt interpreter binaries executing from user-writable paths (%PUBLIC%, %APPDATA%, %TEMP%)
- User awareness training targeting business-cooperation/partnership-themed phishing lures
Timeline of The TTF Trap
- Initial October 2025 loader variant uses a comparatively simple decryption chain (string reversal, base64 decoding, ROT-style cipher) and injects the final payload via CreateRemoteThread, predating the later page-guard/VEH-based segmented decryption approach.
- Earliest observed version of the Lua-based TTF loader is developed, per Fortinet's hash telemetry.
- Campaign distribution scales up into active large-scale phishing waves impersonating legitimate businesses with cooperation lures, first observed by Fortinet in late March 2026.
- Observed use of Discord CDN attachment links (cdn.discordapp.com) to host malicious JScript-in-PDF-disguise droppers.
- Fortinet observes an alternate AutoIt-based loader path alongside the Lua loader, using colorcpl.exe process hollowing.
- June 2026 loader variant adds API-unhooking and software/hardware breakpoint neutralization on top of existing VEH-based segmented shellcode decryption.
- Most recent loader/payload samples collected by Fortinet in this reporting window.
- Fortinet publishes 'The TTF Trap' threat research blog documenting the full campaign, infection chain, and IOCs.
Sources cited for The TTF Trap
- The TTF Trap: A Global Campaign of a Low-Detection Lua Loader
- Agent Tesla, Software S0331
- Remcos, Software S0332
- Agent Tesla Malware Analysis: How This .NET RAT Steals Your Data
- Remcos RAT Analysis: How the Windows Remote Access Trojan Operates
- Remcos Revisited: Inside the RAT's Evolving Command-and-Control Techniques
- Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four
- XWorm v7 RAT: Technical Analysis of Infection Chain & C2
- Input Capture: Keylogging, T1056.001
Threats related to The TTF Trap
- Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations
- Remcos RAT Delivered via CVE-2017-0199 Phishing Campaign Impersonating Payment Confirmations
- Agent Tesla Multi-Stage Phishing Campaign with Process Hollowing of Aspnet_compiler.exe and SMTP Credential Exfiltration
- SnakeKeylogger Infostealer Delivered via Phishing Emails Disguised as Project Proposals (ASEC, JS→PowerShell Fileless Loader)
- MedusaHVNC: Malware-as-a-Service RAT Uses Hidden Desktop (hVNC) to Hijack Live Browser Sessions and Steal Credentials
- TCLBANKER Brazilian Banking Trojan — Trojanized Logi AI Prompt Builder DLL Sideload with WhatsApp and Outlook Worm Modules (REF3076)
Detection coverage for TL-2026-1418
As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1418 across Splunk SPL, Microsoft KQL and Sigma, covering 50 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1418
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.