The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

Since March 2026, threat actors have run a large-scale phishing campaign that uses obfuscated JScript droppers to deploy AutoIt or LuaJIT loaders (often masquerading as .ttf files) which decode and execute Donut-wrapped shellcode in-memory to install RATs and keyloggers (Remcos, Agent Tesla, XWorm, Best Private LOGGER/Snake variant). The report documents multi-stage, fileless techniques, advanced anti-analysis and evasion measures, IOCs (IPs, domains, hashes), and Fortinet detection signatures and mitigation recommendations.