Cybercriminals are now using ordinary font files to deliver low-detection malware.
According to research by experts, a global phishing campaign is actively utilizing heavily obfuscated JavaScript and a Lua-based loader that pose as a TrueType Font ("TTF") file in order to bypass security while it drops RATs and infostealers.
Malware families deployed include Agent Tesla, Remcos, XWorm, and a Snake Keylogger variant called Best Private LOGGER. This malware is capable of stealing credentials and establishing persistence in compromised systems.
This campaign has been active since at least March 2026.
Victims receive phishing emails impersonating well-known companies designed to trick them into opening compressed archives. These archives contain the compressed JavaScript that enables persistence and a malicious script inside a .ttf extension.
The .ttf extension, a fake font file, runs multiple de-obfuscation steps before decrypting and executing shellcode directly into memory.
Source: https://www.csoonline.com/article/4198165/fake-ttf-files-deliver-stealthy-malware-in-global-phishing-campaign.html
Commentary
These recent cyber attacks are utilizing a file extension change to bypass controls that rely on extension for inspection.
File extensions are metadata. They describe what a file claims to be, not what it actually is. When these file extensions are treated as an assertion of file type, mail gateways and endpoints may inspect the file with the wrong tools, failing to catch malware.
The actual content of the file must be inspected. Inspection at the mail gateway and on the endpoint identifies real file types by looking at the actual file content. A file that says .ttf but whose bytes describe a script or archive can be recognized and treated appropriately, not simply as a font.
These attacks are still being perpetrated using the oldest technique in the cyber attack book - phishing.
Cybersecurity training that focuses on identifying, avoiding, and reporting phishing messages will always be a valuable tool in any cyber attack defense tool kit.
Training should also include realistic simulations to teach staff how to recognize phishing messages in many different forms.
The final takeaway is that file extensions may lie. Organizations should add content inspection at the mail gateway and endpoints as cybersecurity control to reduce the likelihood of successful campaigns that rely on malicious file extensions. That, combined with continued cybersecurity training about phishing, may help avoid the risks.
