The TTF Trap campaign represents a sophisticated, multi-stage malware delivery operation that has remained largely undetected since its inception due to novel evasion techniques and a carefully layered infection chain. First observed by FortiGuard Labs via samples dating to October 2025, the campaign escalated significantly in late March 2026 and continued evolving through June 2026.

Initial Access & Delivery: Attackers send phishing emails impersonating well-known companies using business cooperation and payment-related lures. These emails contain compressed archives (ZIP/RAR) or download links pointing to malicious payloads hosted on legitimate services. One confirmed staging URL abuses Discord's CDN infrastructure: hxxps://cdn.discordapp.com/attachments/1499192125093449759/1511147377979818074/F10097782_Request-9200090_0990.PDF.JS.

Stage 1 — JScript Dropper: The archive contains an obfuscated JScript file employing heavy anti-analysis: string array mapping (critical strings accessed by index), control flow flattening (complex branching to confuse analysis), and anti-tampering integrity checks. ActiveX object names and output file paths use junk delimiters removed at runtime via .split() and .join(). The script verifies that next-stage files are absent and a specific variable is set to 'YESSSSSSSS' before proceeding. If conditions are met, it copies itself to %PUBLIC%\Libraries and establishes persistence via a scheduled task with a 15-minute repeat interval using schtasks /create /sc minute /mo 15. The dropper then reverses hardcoded strings, strips junk delimiters, Base64-decodes, and writes to disk: either a LuaJIT interpreter executable (LuaJIT 2.1.0-beta3) with a disguised .ttf script file, or an AutoIt interpreter with accompanying script and encoded data.

Stage 2 — LuaJIT Loader (.ttf disguise): The .ttf file is not a font but a disguised Lua script. The LuaJIT interpreter executes it, passing the .ttf script as a parameter. The Lua loader performs a three-step decryption: (1) string reversal with symbol substitution (replacing ~@#:&*>< with ABCDa bcd), (2) Base64 decoding, and (3) a custom ROT cipher where the rotation key is derived from the first byte (formula: 94 - {first_byte} - 128), producing printable ASCII. The decrypted payload is Donut-generated shellcode. The Lua loader employs extensive anti-analysis: decoy memory allocation filled with suspicious strings and fake driver error messages (0xDEADBEEF, 0x1337C0DE), a PatchDonut64Header function that scans for and obfuscates Donut shellcode byte/string signatures using mask values 144 and 204, and in-memory XOR encryption/decryption cycles on shellcode with a consistent key.

Stage 2 (Alternate) — AutoIt Loader: An alternative variant drops the AutoIt interpreter, an obfuscated AutoIt script with randomized long-form variable names and string encryption, and an XOR-encrypted data file. The deobfuscated script launches C:\Windows\Syswow64\colorcpl.exe as a suspended process, reads and decrypts the local data file with XOR, and uses low-level ntdll.dll functions (NtCreateThreadEx, NtAllocateVirtualMemory) for process injection, allocating oversized memory regions for evasion.

Stage 3 — Donut Shellcode & Reflective Loading: The final payload is wrapped using the Donut shellcode generator. Upon successful shellcode execution, Donut's built-in reflective loader maps and executes the payload directly in memory without touching disk, achieving a fully fileless state.

June 2026 Variant — Advanced Evasion: The latest variant introduces several sophisticated capabilities. API unhooking actively neutralizes userland EDR hooks. Hardware breakpoint neutralization defeats both Lua and native debuggers. AMSI and ETW bypass using 'xor eax, eax, ret' instruction sequences blinds .NET and script runtime inspection. Direct syscalls bypass userland API hooks entirely. The most notable innovation is VEH-based segmented shellcode encryption: the shellcode is partitioned into page-sized segments, each independently encrypted and marked PAGE_NOACCESS. A Vectored Exception Handler is registered to intercept access violations — when execution hits a protected page, the exception triggers the VEH which decrypts that block and restores execution permissions, providing segment-by-segment on-demand decryption.

Payloads: The campaign delivers a diverse set of commodity malware families. Agent Tesla performs credential theft, keystroke logging, screen capture, and clipboard monitoring. Remcos provides full remote administrative control. XWorm functions as a modular RAT and infostealer. Snake Keylogger (under the name 'Best Private LOGGER') uses the same collection module and coding style as Snake, with minor signature modifications — a VIP variant also adds anti-analysis capabilities and Wi-Fi harvesting. FortiGuard also detected Formbook in some JScript samples.

C2 Infrastructure: The campaign uses a mix of dynamic DNS (newremupdate.duckdns.org:2404), compromised mail servers (mail.teamengineersgroup.com, mail.allportcargoservice.com, mail.trimnt.com, mail.taikei-rmc-co.biz), and IP-based C2 endpoints (104.239.66.86:7004, 46.183.223.21:2404, 107.174.34.137:443). C2 communication uses both web protocols and mail protocol impersonation.

The loader's low detection rates stem from the .ttf file extension bypassing human inspection, fileless final payload execution evading disk scanning, AMSI/ETW bypass techniques blinding runtime inspection, API unhooking and direct syscalls bypassing userland EDR hooks, and Discord CDN abuse circumventing domain-level URL filtering. The campaign remains active as of the July 2026 publication.