Hackers Hide Lua Loaders in Fake TTF Files to Deploy Remcos, XWorm, and Agent Tesla

Hackers are increasingly abusing trusted file formats and lightweight scripting environments to evade detection, with a newly observed campaign leveraging Lua-based loaders.

Disguised as TrueType (.ttf) font files to deploy commodity malware, including Remcos RAT, Agent Tesla, XWorm, and Snake Keylogger variants.

The campaign impersonates legitimate businesses and brands in email lures, often using payment-themed pretexts to pressure victims into opening malicious archives.

The attack begins with phishing emails containing either malicious attachments or download links.

Inside the archive, victims encounter heavily obfuscated JavaScript loaders padded with junk code and protected by control flow flattening, string array mapping, and anti-tampering techniques.

Critical strings such as ActiveX objects and file paths are dynamically reconstructed at runtime using split-and-join operations to bypass signature-based detection.

Execution is gated by conditional checks before persistence is established via Scheduled Tasks, with the script copying itself into the %PUBLIC%\Libraries directory.

The loader then extracts embedded payloads through a multi-step routine involving string reversal, delimiter stripping, and Base64 decoding, ultimately dropping components such as LuaJIT or AutoIt interpreters alongside encoded data blobs.

A key innovation in this campaign is the abuse of .ttf files as containers for Lua scripts. These files are not fonts but obfuscated Lua loaders executed via LuaJIT.

Fortinet researchers have tracked phishing-driven operations combining fileless execution, multi-layered obfuscation, and low-detection LuaJIT loaders.

Metadata artifacts within the dropped binaries confirm the presence of LuaJIT components and its Foreign Function Interface (FFI), which allows direct interaction with native APIs.

Lua Loaders in Fake TTF Files

The Lua loader employs a layered decryption pipeline. Hardcoded payload strings are reversed and symbol-substituted before Base64 decoding.

A custom rotation cipher is then applied using a dynamic key derived from the payload’s first byte, following the formula 94−first_byte−12894 – \text{first\_byte}. This ensures the decrypted output remains within printable ASCII while complicating static analysis.

To further evade detection, the loader allocates decoy memory regions filled with random data, patches recognizable Donut shellcode signatures, and applies XOR-based in-memory encryption cycles.

Execution is ultimately achieved through protected function calls that invoke shellcode via native C function pointers.

Recent variants observed in June 2026 demonstrate significant evolution. The loader incorporates anti-debugging techniques such as API unhooking and breakpoint neutralization.

It also implements segmented shellcode encryption, where payloads are divided into memory pages marked as non-accessible.

Execution relies on a Vectored Exception Handler (VEH), which intercepts access violations, decrypts the required memory segment on demand, and restores execution permissions.

This technique effectively hides malicious code until runtime, complicating both static and dynamic analysis.

The final payload is delivered using the Donut shellcode generator, which enables in-memory execution of PE files via reflective loading.

This allows malware to operate without touching disk, significantly reducing forensic artifacts. Donut has been widely abused in prior campaigns, including PureHVNC deployments documented by Fortinet.

Parallel campaigns replace Lua with AutoIt-based loaders. In these cases, attackers drop an AutoIt interpreter, script, and encoded payload.

The script launches legitimate processes such as colorcpl.exe in suspended mode, injects decrypted shellcode using low-level ntdll.dll functions, and resumes execution.

This technique mirrors earlier Remcos campaigns analyzed by G Data, highlighting consistent tradecraft across different loader implementations.

The campaign delivers a range of commodity malware, including Remcos RAT, Agent Tesla, XWorm, and a variant labeled “Best Private LOGGER.”

Analysis confirms that Best Private LOGGER is a modified Snake Keylogger, sharing identical data collection modules and code structure with Snake VIP Keylogger builds.

These payloads enable full system compromise, including credential theft, keystroke logging, remote control, and data exfiltration.

The use of business email compromise (BEC) themes and trusted branding significantly increases infection success rates.

Tracking samples from October 2025 through June 2026 reveals rapid iteration in loader complexity. Early variants relied on simpler ROT-based decoding and CreateRemoteThread injection, while newer versions integrate layered encryption, VEH-based execution, and extensive anti-analysis logic.

This campaign underscores a growing trend: attackers blending scripting languages like Lua and AutoIt with fileless execution and shellcode frameworks such as Donut to bypass modern defenses.

The abuse of benign file extensions like .ttf further highlights the need for deeper content inspection and behavioral detection across enterprise environments.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide