Attackers Combo Up Evasion Tactics for BEC Phishing
Attackers are employing increasingly sophisticated evasion techniques to deliver BEC phishing attacks, utilizing a multi-stage process involving disguised font files, Lua interpreters, and fileless execution to bypass endpoint defenses. The campaign, dubbed "The TFF Trap," leverages a combination of techniques to deploy malware families like Agent Tesla, Remcos, XWorm, and Best Private Logger, impersonating legitimate companies like FedEx to trick victims into executing malicious attachments. Organizations should focus on limiting post-compromise access through identity and access controls and scrutinizing urgent requests from unfamiliar sources.
Attackers are employing increasingly sophisticated evasion techniques to deliver BEC phishing attacks, utilizing a multi-stage process involving disguised font files, Lua interpreters, and fileless execution to bypass endpoint defenses. The campaign, dubbed "The TFF Trap," leverages a combination of techniques to deploy malware families like Agent Tesla, Remcos, XWorm, and Best Private Logger, impersonating legitimate companies like FedEx to trick victims into executing malicious attachments. Organizations should focus on limiting post-compromise access through identity and access controls and scrutinizing urgent requests from unfamiliar sources.
Researchers at Fortinet have observed the campaign since late March. The core of the attack involves a TrueType Font (.ttf) file that actually contains encrypted Lua bytecode, disguised as a legitimate font file. This file is used to deliver a Lua-based loader, which then decrypts and executes malicious code directly in memory, minimizing forensic artifacts and reducing the likelihood that antivirus (AV) or even some behavior security tools will detect the malicious activity. The loader utilizes a Lua interpreter to execute the payload, further obscuring its activity.
The attack begins with a phishing email mimicking a trusted company, such as FedEx, designed to encourage immediate action. Once a victim executes a malicious attachment – typically a heavily obfuscated JavaScript – a second-stage loader is initiated. Instead of dropping a conventional executable, the malware deploys a legitimate LuaJIT or AutoIt interpreter alongside the disguised .ttf file. The interpreter then decrypts and executes the malicious code directly in memory, performing anti-analysis checks and unhooking Windows APIs to evade detection.
Fortinet has provided a comprehensive set of Indicators of Compromise (IoCs), including URLs, Jscripts, Lua scripts, and command-and-control (C2) network addresses, to assist defenders in tracking this campaign. Organizations should implement identity and access controls to limit an attacker's reach once initial access is gained, enforcing least privilege, requiring re-authentication for sensitive systems, and monitoring for anomalous session behavior. Furthermore, employees should be trained to scrutinize urgent requests from unfamiliar sources and verify communications through separate channels.