Executive Summary
Since late March 2026, a high-scale global phishing campaign dubbed 'The TTF Trap' has been targeting organizations by impersonating reputable brands for business collaboration. The campaign is notable for its sophisticated multi-stage execution chain designed to bypass detection through fileless techniques and the use of unconventional scripting environments like LuaJIT and AutoIt.
The attack flow utilizes heavily obfuscated JScript droppers that establish persistence and drop a legitimate interpreter alongside a malicious script disguised with a .ttf extension. This script acts as a secondary loader, employing complex decryption routines and anti-analysis features such as decoy memory allocation and Vectored Exception Handling (VEH) to inject shellcode. The campaign primarily distributes Remote Access Trojans (RATs) and infostealers, including Remcos, Agent Tesla, XWorm, and a specific variant of Snake Keylogger branded as 'Best Private LOGGER'.
This threat poses a high risk due to its ability to achieve full remote administrative control and facilitate extensive data exfiltration while maintaining a low detection profile through continuous updates and evasion-heavy tradecraft.