A phishing operation running since late March disguises its malware as an ordinary font file and executes it in memory, leaving antivirus tools almost nothing to scan.

 

What happened

Attackers impersonating FedEx and other shipping and logistics companies have been distributing remote access trojans, malicious programs that let an intruder control a computer from a distance, alongside infostealers built to harvest saved passwords and browser data, Dark Reading reported on July 20, 2026. Researchers tracking the operation named it "The TFF Trap" for its use of a TrueType Font file, the everyday .ttf format computers rely on to display typefaces, as a container for malicious code. The opening message is styled as routine business correspondence, a note about a shipment or a partnership from a company the recipient already deals with. Victims who open the attachment trigger a chain ending in malware families including Agent Tesla, Remcos, XWorm, and Best Private Logger running on their Windows machines. Targets span organizations worldwide rather than any single sector.

 

Going deeper

Every stage of the chain is built against a different defensive layer, according to Dark Reading's account of the research. The attachment is a heavily obfuscated JavaScript file, padded with junk code and rearranged logic so scanners cannot easily read what it does, and it establishes persistence before launching the next stage. Next, rather than dropping a conventional program, the malware deploys a legitimate LuaJIT or AutoIt interpreter, ordinary software built to run scripts, and pairs it with the fake font file, which holds encrypted Lua bytecode. The interpreter decrypts and runs that code directly in memory, then reflectively loads the final payload without ever writing it to the hard drive, an approach called fileless execution that leaves investigators with almost nothing to recover. The code also runs anti-analysis checks and unhooks Windows programming interfaces, cutting the tripwires endpoint security tools attached to the operating system to observe suspicious behavior. None of these techniques is new on its own. Seeing all of them stacked in a single campaign at this scale is what drew attention, since a tool judging files by extension sees a font, a signature-based scanner finds nothing familiar, and a behavioral tool watches a trusted interpreter behaving like an interpreter.

 

What was said

Researchers who documented the campaign described the deception, writing that "the core loader script is disguised as a .ttf extension" in findings published July 16, 2026, and reported by Dark Reading four days later. They traced the loader's development across several months and found it revised repeatedly to stay ahead of detection and frustrate analysis.

 

In the know

Everything about this operation is engineered to work after someone has already clicked, which shifts the useful question from prevention alone toward containment. Least privilege, the practice of granting each account only the access its holder genuinely needs, caps what a stolen credential can reach. Requiring fresh authentication before sensitive systems open stops a hijacked session from roaming. Monitoring for unusual session behavior catches what the endpoint agent missed. None of that keeps the message out of the inbox, though it narrows what an attacker accomplishes once one lands. The financial pull behind the lure explains why attackers keep refining this approach. Business email compromise produced $3.046 billion in reported losses during 2025, the second-largest category tracked in the FBI Internet Crime Complaint Center's annual report, trailing only investment fraud. Security teams hunting this campaign can pull the published indicators of compromise, the technical fingerprints such as web addresses, scripts, and command-and-control network addresses that mark an intrusion, and load them into monitoring tools to check whether the activity has already reached their environment.

 

The big picture

Healthcare organizations sit directly in the path of this kind of lure because so much of their daily correspondence arrives from outside parties, including shipping partners, suppliers, billing vendors, and reference labs. A message that looks like a delivery notice gets opened in a busy administrative office without a second thought, which is the reflex the campaign was designed around. Paubox's report on the top three healthcare email attacks identified executive and vendor impersonation as one of three patterns behind nearly every email-related healthcare breach in 2025, with almost one in three reported breaches involving a business associate. Malware that never touches the disk defeats the assumption sitting underneath most endpoint defenses, that something detectable gets written down somewhere. Filtering that weighs a message by sender behavior, phrasing, and impersonation signals rather than waiting to recognize a malicious attachment stops the sequence before the first stage ever runs.

 

FAQs

Why would attackers use a scripting language like Lua instead of writing a normal program?

Antivirus engines are strongest at scanning compiled executable files, so moving the malicious logic into script code run by a legitimate interpreter shifts it somewhere those engines look less carefully. Lua is compact and rarely associated with malware, which lowers the chance its presence alone raises a flag.

 

What does it mean when malware "unhooks" security tools?

Endpoint protection software monitors a system by attaching small hooks to the Windows functions programs call to open files, start processes, or reach the network. Stripping those hooks restores the original unmonitored versions, which blinds the security tool while the system appears to keep running normally.

 

If nothing is written to disk, how does anyone investigate a fileless infection?

Responders turn to memory forensics, capturing a snapshot of the machine's RAM before it powers down, alongside logs of process activity, network connections, and script execution. Windows features such as PowerShell logging and Sysmon telemetry become the primary evidence when there is no file left to recover.

 

Do remote access trojans and infostealers create HIPAA obligations without ransomware?

Yes. Unauthorized access to systems holding electronic protected health information triggers breach analysis duties whether or not data was encrypted or held for ransom. An infostealer capturing credentials to an email account or patient portal can amount to a reportable breach even if the attacker deploys nothing further.

 

How does behavioral email filtering differ from blocking a malicious attachment?

Traditional filtering compares attachments and links against catalogs of known threats, which fails against novel loaders and files that look clean. Behavioral filtering assesses the message itself, weighing sender reputation, writing patterns, urgency cues, and impersonation markers, so it can stop a fraudulent business request carrying nothing technically malicious at all.