“TTF Trap” Uses Fake Font Files to Drop Malware

How the Attack Worked

The TTF Trap campaign relies on phishing emails disguised as routine business communication such as invoices, shipping documents, payment requests, or business proposals. These messages impersonate established companies and are designed to create urgency so recipients act quickly without scrutiny. Some emails carry ZIP or RAR archive attachments directly, while others provide a link that downloads the archive.

Inside the archive, the real danger is a file with a .ttf extension, normally associated with TrueType fonts. In this campaign, that file is not a font at all but a disguised Lua script. Opening the archive triggers an obfuscated JScript that establishes persistence through a scheduled task, then drops a legitimate interpreter such as AutoIt or LuaJIT alongside the disguised .ttf script. The loader executes shellcode in memory and may inject into a legitimate Windows process, such as colorcpl.exe, to reduce the chance of detection.

Why It Succeeded

The campaign succeeds by exploiting trust in ordinary business processes. Finance, accounts payable, procurement, and operations staff regularly handle invoices, orders, and shipping paperwork, making these pretexts unremarkable at first glance. The use of a familiar-seeming file extension like .ttf adds a layer of false reassurance, since employees are unlikely to associate a font file with executable danger. Combined with urgency cues pushing quick action on payment or shipping matters, the attack reduces the likelihood that a recipient pauses to verify.

What to Watch For

• Unexpected invoice, order, shipping, or payment-related emails from unfamiliar or unverified senders
• ZIP or RAR archive attachments accompanying routine business documents
• A .ttf file bundled inside a business archive, since fonts are not normally needed to read invoices or shipping documents
• Links that lead to downloading an archive instead of standard document sharing
• Messaging that pressures quick action, particularly around payments or order processing

Building Resistance

The final payloads observed in this campaign, including Agent Tesla, Remcos, XWorm, and Snake Keylogger variants, are used for credential theft, keystroke logging, and remote access, making early detection critical. Employees should verify unexpected orders, invoices, or shipping files with the supposed sender through a separate, known-good communication channel rather than acting on the email alone. File extensions cannot confirm what a file actually contains, so any archive requiring an interpreter or script to open unusual file types should be treated with suspicion. Reporting messages that create urgency around payment or document review, rather than acting on them immediately, helps limit the campaign's reach across finance, procurement, and operations teams.

What is the TTF Trap phishing campaign?

TTF Trap is a phishing operation where emails posing as invoices, shipping documents, or business proposals deliver an archive containing a file with a .ttf extension that is actually a malicious Lua script, not a real font.

How does the fake font file lead to malware infection?

Opening the archive runs an obfuscated JScript that sets up persistence via a scheduled task, then drops a legitimate interpreter along with the disguised .ttf script, which executes shellcode in memory and can inject into a legitimate Windows process.

What malware is delivered through this campaign?

Observed final payloads include Agent Tesla, Remcos, XWorm, and Snake Keylogger variants, which are used for credential theft, keystroke logging, and remote control.

How can employees spot this type of attack?

Watch for unexpected invoice, order, or shipping-related emails that push urgency, especially those with ZIP or RAR attachments or download links, and treat any unusual file type inside a business archive, such as a .ttf file, as suspicious.