An email that appears to contain a shipping document, payment request, or business proposal can infect a Windows computer, even if one of its main components has a .ttf extension.
FortiGuard Labs has named the operation “TTF Trap” after finding widespread phishing activity that uses disguised font files and low-detection Lua loaders. The campaigns have been active since late March 2026, although researchers traced early versions of the loader to October 2025. Fortinet rates the threat as High and says any organization using Windows could be targeted. For context, TTF stands for TrueType Font, a common font format on Windows. In this campaign, the .ttf file is not a real font. Attackers use the familiar extension to disguise a malicious Lua script that installs malware when executed by a separate program.[1]
Phishing Emails - The emails impersonate established companies and address recipients with requests for orders, invoices, shipping documents, payments, or business cooperation. Some messages contain ZIP or RAR archives, while others provide links that download the archive. The sender creates a sense of urgency to persuade the recipient to open the included files.
Email& Messaging
Phishing emails (Image credit: FortiGuard Labs)
Opening the archive launches a heavily obfuscated JScript file filled with junk code designed to hinder automated scanning and manual inspection. The script copies itself to the Windows Public Libraries folder, creates a scheduled task to ensure persistence, and decodes additional files embedded in its code.
Among the dropped files is a legitimate AutoIt or LuaJIT interpreter accompanied by a malicious script. That script may use a .ttf extension, making it appear to be a TrueType Font even though its contents contain executable Lua code. The interpreter reads the disguised file, decrypts its contents, and runs the next stage.
Once decoded, the loader executes the Donut shellcode directly in memory, reducing the number of malicious files written to disk. A related AutoIt version launches the legitimate Windows colorcpl.exe process in a suspended state, then injects and runs the payload inside it.
ComputerDrives & Storage - Fortinet’s analysis found that newer loader versions added additional anti-analysis methods, making debugging and detection more difficult.
The final malware varies between attacks. FortiGuard Labs observed Agent Tesla, Remcos, XWorm and several Snake Keylogger variants, including Best Private LOGGER. These tools can steal credentials and other information, record keystrokes, or give attackers remote control of an infected computer.
Expert Perspective - Jason Soroko, Senior Fellow at Sectigo, said the campaign shows why a filename or extension cannot confirm what a file contains. The interpreter, script, and disguised font may appear less suspicious when reviewed separately, but their combined execution delivers remote access tools and information-stealing malware.
Soroko advised organizations to inspect the file's contents, behavior, and execution context. Email gateways and sandboxes should open nested archives, follow embedded download links and identify scripts carrying misleading extensions. Where they are not needed, Windows Script Host, AutoIt and LuaJIT should be restricted through application control, particularly in user-writable folders.
Because the loader has changed repeatedly, Soroko said detection should not depend only on file hashes or command servers listed in published indicators. Monitoring should also cover script interpreters launched from email or archive programs, unusual use of colorcpl.exe, remote memory allocation, process injection, and shellcode execution.
ComputerDrives & Storage - Employees receiving unexpected orders, invoices, or shipping files should verify the request with the supposed sender through a separate communication channel. A .ttf file inside a business archive should never require an interpreter or script to run, and any request involving such files should be reported before opening them.
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5207428251321676122
[1] https://hackread.com/ttf-trap-phishing-fake-font-files-windows-malware/
Comments