Attackers Combo Up Evasion Tactics for BEC Phishing

Fortinet researchers have identified a wide-scale phishing campaign dubbed "The TFF Trap" that impersonates logistics companies to trick victims into executing obfuscated JavaScript which stages a second-stage loader. The attackers deliver a legitimate LuaJIT or AutoIt interpreter alongside a file disguised as a .ttf font that contains encrypted Lua bytecode; that loader decrypts and executes payloads in memory, unhooks Windows APIs, and reflectively loads final malware (Agent Tesla, Remcos, XWorm, Best Private Logger) to evade detection. Fortinet published IoCs (URLs, scripts, C2 addresses) and guidance emphasizing phishing defenses, identity and access controls, and employee verification of urgent requests.