Phishers Hide Lua Malware as “.TTF Font”

How the Attack Worked

This campaign relied on phishing emails carrying payment-themed prompts and business-cooperation lures, often impersonating well-known companies to build trust with the recipient. Victims were pushed to open malicious archive attachments that appeared to contain a harmless TrueType font file. In reality, the file used a fake .ttf extension while the operating system treated it as a script rather than a font.

Once executed, the script ran heavily obfuscated JavaScript designed to defeat manual and automated analysis. It set up persistence through a scheduled task and used fileless, largely in-memory execution to lower its visibility to security tools. From there, the loader delivered a range of payloads including Remcos, Agent Tesla, XWorm, and a Snake Keylogger variant, all geared toward stealing credentials and maintaining long-term access.

Why It Succeeded

The campaign succeeded by combining a believable business pretext with a file-type trick that most people would not question. Payment and cooperation themes are common in Finance, Accounts Payable, Procurement, and Executive Assistant workflows, so an attachment referencing a payment or settlement did not stand out as unusual on its own. Layering that pretext with a file disguised as a font, an object type rarely scrutinized in day-to-day email handling, gave the payload a second layer of cover. The heavy obfuscation and in-memory execution further reduced the odds that security tooling would flag the activity before credentials were exposed.

What to Watch For

• Unexpected archive attachments tied to payment or business-cooperation requests
• A ".ttf" or other font file appearing inside a business or payment-related email
• Attachments that open in a scripting engine rather than a standard document or image viewer
• Requests to "double-click" or run a file to view payment details, rather than opening a normal PDF or document

Building Resistance

Organizations can reduce exposure by training employees, especially those in Finance, Accounts Payable, and Procurement roles, to treat unexpected archive attachments as high-risk and to verify sender requests through a known-good channel before opening anything. Staff should be reminded that file extensions and names are not proof of what a file actually is, and unusual types like ".ttf" appearing in a business context are worth reporting.

Because the ultimate goal of this kind of loader chain is credential theft, limiting the damage stolen credentials can cause matters as much as preventing the initial click. Enforcing least privilege and requiring re-authentication for sensitive systems and actions helps ensure that even if a credential is compromised, its usefulness to an attacker is limited.

How did attackers disguise the malware as a font file?

The malicious loader was given a fake .ttf extension so it looked like a legitimate TrueType font, but it was actually treated as a script when executed.

What malware was delivered through this campaign?

Observed payloads included Remcos, Agent Tesla, XWorm, and a Snake Keylogger variant referred to as "Best Private LOGGER," all aimed at credential theft and persistence.

What lures were used to get victims to open the attachment?

Attackers used payment-themed prompts and business-cooperation lures, often impersonating well-known companies, to convince recipients to open malicious archives.

How did the malware avoid detection?

The chain used heavy JavaScript obfuscation, a scheduled task for persistence, and fileless or mostly in-memory execution to reduce the chance of detection.