# The TTF Trap: Global Phishing Campaign Delivers Lua-Based Loader for Agent Tesla, Remcos RAT, XWorm

> Fortinet reports a large-scale, ongoing phishing campaign (tracked activity spanning October 2025 through June 2026, actively distributed since late March 2026) that disguises a Lua-based loader as .ttf font files. Multi-layered obfuscation (junk-code JScript, Donut shellcode, Vectored Exception Handler-based segmented encryption) deploys Agent Tesla, Remcos RAT, XWorm, and a Snake Keylogger variant ('Best Private LOGGER') against Windows targets worldwide.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1418
- **ID:** TL-2026-1418
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 50 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The 'TTF Trap' campaign, documented by Fortinet's threat research team, is a global, ongoing phishing operation active since at least October 2025 (loader development) with widespread distribution beginning late March 2026 and continuing through June 2026. Threat actors impersonate reputable companies using business-cooperation lures, sending malicious archive attachments or download links via email and via Discord CDN-hosted attachments.

The infection chain begins with a JScript dropper obfuscated via string-array mapping, control-flow flattening, and anti-tampering/anti-analysis checks. The script copies itself to %PUBLIC%\Libraries and establishes persistence via a Windows Scheduled Task, re-executing only when a companion 'YESSSSSSSS' variable and the absence of next-stage files indicate the chain has not yet completed.

The dropper stages a file disguised with a legitimate .ttf (TrueType Font) extension that in reality bundles a Lua or AutoIt interpreter executable, a loader script, and base64/ROT-obfuscated encoded payload data — a masquerading technique (T1036.005) intended to slip past extension-based filtering and analyst triage. The Lua loader variant decrypts its payload through a three-step process: string reversal with symbol substitution (~→A, @→B, #→C, :→D, &→a, *→b, >→c, <→d), base64 decoding, and a custom rotation cipher where the rotation value is computed as 94 − first_byte − 128. An alternative AutoIt loader path performs equivalent functionality using obfuscated AutoIt scripts with string encryption, launching C:\Windows\Syswow64\colorcpl.exe as a suspended process and injecting into it via ntdll.dll process-hollowing primitives, backed by oversized memory allocations intended to evade heap-based sandbox heuristics.

Both loader paths converge on execution of Donut-generated shellcode. The Lua loader applies extensive anti-analysis tradecraft before that point: decoy memory allocations filled with suspicious strings and random data to mislead memory scanners, a custom PatchDonut64Header routine that masks Donut's distinctive shellcode signature bytes with a mask value (144, 204, plus randomized uppercase bytes), repeated in-memory XOR encryption/decryption cycles, memory page-guard tricks, and (in the June 2026 variant) active API-unhooking and software/hardware breakpoint neutralization aimed at defeating EDR hooks and debuggers. The most distinctive technique is the use of a Vectored Exception Handler (VEH) to decrypt the shellcode in page-guarded segments only on access — each segment is decrypted on demand when a guard-page access violation fires the VEH, and re-encrypted/discarded afterward, so a full plaintext copy of the shellcode is never resident in memory at once.

Once triggered, the Donut shellcode's built-in reflective loader maps and executes the final payload directly in memory, achieving a fileless final stage. Observed final payloads are Agent Tesla (.NET-based credential-stealing RAT/keylogger), Remcos RAT (commercial-grade surveillance/remote-access trojan marketed by Breaking Security and widely abused by criminal actors), XWorm (feature-rich commodity RAT with ransomware/DDoS plugin capability), and a Snake Keylogger variant tracked by Fortinet as 'Best Private LOGGER' — a modified-signature build sharing collection modules and coding style with the Snake VIP Keylogger builder, functioning as an infostealer/keylogger.

Command-and-control infrastructure spans dedicated IP:port pairs and dynamic-DNS/compromised-mail-subdomain fronting (DuckDNS entries and 'mail.' subdomains on business-cooperation-themed domains), consistent with commodity malware-as-a-service tooling rented or resold to multiple operators rather than a single dedicated actor group. No CVE is associated with this campaign — it is a social-engineering and loader-technique story, not a vulnerability exploit chain.

## MITRE ATT&CK

- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1204 User Execution
- T1203 Exploitation for Client Execution
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1055 Process Injection
- T1548 Abuse Elevation Control Mechanism
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1564 Hide Artifacts
- T1685 Disable or Modify Tools
- T1574 Hijack Execution Flow
- T1112 Modify Registry
- T1070 Indicator Removal
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1056 Input Capture
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1016 System Network Configuration Discovery
- T1012 Query Registry
- T1010 Application Window Discovery
- T1083 File and Directory Discovery
- T1113 Screen Capture
- T1125 Video Capture
- T1123 Audio Capture
- T1115 Clipboard Data
- T1560 Archive Collected Data
- T1185 Browser Session Hijacking
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1568 Dynamic Resolution
- T1573 Encrypted Channel
- T1090 Proxy

## Sources

- [The TTF Trap: A Global Campaign of a Low-Detection Lua Loader](https://www.fortinet.com/blog/threat-research/the-ttf-trap-a-global-campaign-of-a-low-detection-lua-loader)
- [Agent Tesla, Software S0331](https://attack.mitre.org/software/S0331/)
- [Remcos, Software S0332](https://attack.mitre.org/software/S0332/)
- [Agent Tesla Malware Analysis: How This .NET RAT Steals Your Data](https://www.picussecurity.com/resource/blog/agent-tesla-malware-analysis-how-this-.net-rat-steals-your-data)
- [Remcos RAT Analysis: How the Windows Remote Access Trojan Operates](https://www.picussecurity.com/resource/blog/remcos-rat-analysis-how-the-windows-remote-access-trojan-operates)
- [Remcos Revisited: Inside the RAT's Evolving Command-and-Control Techniques](https://www.pointwild.com/threat-intelligence/remcos-revisited-inside-the-rats-evolving-command-and-control-techniques/)
- [Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four](https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four)
- [XWorm v7 RAT: Technical Analysis of Infection Chain & C2](https://gurucul.com/blog/xworm-v7-rat-technical-analysis-of-infection-chain-c2-protocol-and-plugin-architecture/)
- [Input Capture: Keylogging, T1056.001](https://attack.mitre.org/techniques/T1056/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1418