Fake Font Attachment Used in Global Phishing

How the attack worked

This phishing campaign impersonates well-known companies and uses business cooperation or payment themed emails to convince recipients to open a compressed archive attachment. Inside the archive is heavily obfuscated JavaScript/JScript that establishes persistence and then drops either a legitimate AutoIt executable or a LuaJIT interpreter, along with a malicious script packaged inside a file with a .ttf extension. That fake font file is actually a Lua-based loader that runs multiple layers of de-obfuscation before decrypting and executing shellcode directly in memory, a fileless approach that helps it evade detection. The end result is deployment of remote access tools and infostealers, including Agent Tesla, Remcos, XWorm, and a Snake Keylogger variant.

Why it succeeded

The campaign relies on a combination of brand impersonation and a familiar business pretext, either a partnership proposal or a payment/invoice notice, to get a recipient to open a compressed attachment without hesitation. Because the payload is hidden inside a file disguised as a font, it exploits an assumption that file extensions reflect actual file type or intent. As one source in the reporting put it, security controls cannot treat a file extension as proof of file type or intent. The technical sophistication of the loader chain only matters because a person first opens the email and the attachment.

What to watch for

• Unexpected compressed (ZIP/RAR) attachments tied to business cooperation or payment requests
• Generic outreach that pushes urgency to open an archive rather than review details in the email body
• Attachment contents that do not match their stated purpose, such as a "font" file behaving like an executable
• Emails impersonating well-known companies using vendor, customer, or partnership language

How to build resistance

Organizations should treat unexpected compressed attachments as high-risk, particularly when tied to business cooperation or payment themes, and encourage verification through a known contact method before opening. Training should focus on the human decision point rather than only technical detail, since the most sophisticated evasion techniques still depend on someone opening an email that looks trustworthy and acting on it. Limiting what stolen credentials can reach through least privilege, requiring re-authentication for sensitive systems, and monitoring for anomalous session behavior can reduce the impact if a phishing email does succeed. Relevant MITRE ATT&CK techniques referenced in this campaign include spearphishing attachment (T1566.001), user execution of a malicious file (T1204.002), obfuscated files or information (T1027), and JavaScript-based scripting execution (T1059.007), which map to detection and response opportunities across the kill chain.

How does the fake font file attack work?

Victims open a compressed attachment from a phishing email that claims to be about business cooperation or payment. Inside is obfuscated script that drops a file disguised as a .ttf font, which is actually a Lua-based loader that decrypts and runs shellcode in memory.

What malware gets installed after the font file loader runs?

Observed payloads include Agent Tesla, Remcos, XWorm, and a Snake Keylogger variant called Best Private LOGGER, all used for credential theft and persistent access on Windows systems.

Why does a .ttf extension bypass suspicion?

File extensions are not proof of file type or intent. A font file extension looks harmless to most employees and can slip past assumptions built into everyday email handling.

Who is most at risk from this phishing campaign?

Finance, accounts payable, sales, business development, procurement and executive assistant roles are commonly targeted because the pretexts center on payment requests and business cooperation.