“TTF Trap” Phishing Emails Use Fake Font Files to Deliver Windows Malware

FortiGuard Labs has identified a high-risk phishing campaign called “TTF Trap” that tricks recipients into opening archives containing obfuscated JScript which drops legitimate interpreters and disguised `.ttf` files that are actually executable Lua/AutoIt scripts. The interpreters decrypt and run loaders (including Donut shellcode and process injection via `colorcpl.exe`) to install info-stealers and RATs such as Agent Tesla, Remcos, XWorm, and Snake Keylogger. Organizations should inspect file contents and behavior, restrict script interpreters (Windows Script Host, AutoIt, LuaJIT), enable sandboxing that opens nested archives and follow embedded links, and treat unexpected `.ttf` attachments in business documents as suspicious.