Fake Font Files Are Hiding Malware That Steals Passwords and Takes Over Windows PCs
A phishing campaign spotted since late March disguises malicious code as font files and runs it entirely in memory, making it nearly invisible to standard antivirus tools. FedEx and other familiar brands are being impersonated to get victims to open the door.
Key points
- Fortinet researchers have tracked "The TFF Trap" phishing campaign since late March 2025, targeting Microsoft Windows users.
- Criminals impersonate FedEx and other shipping companies to trick employees into opening a malicious email attachment.
- The attack hides its malware payload inside a file disguised as a font (a .ttf file, the format your computer uses to display typefaces like Arial), making it harder for security software to spot.
- Four malware families are delivered: Agent Tesla, Remcos, XWorm, and Best Private Logger, all capable of stealing passwords or giving attackers remote control of a machine.
- Fortinet has published indicators of compromise, meaning technical fingerprints defenders can feed into security tools to detect the attack.
Some attacks are clever. Some attacks are sneaky. This one is both, and the combination is what makes it worth paying attention to.
Researchers at cybersecurity firm Fortinet have been watching a campaign they call "The TFF Trap" since late March 2025. The name comes from a trick at the heart of the attack: hiding malicious code inside a file that looks like a TrueType Font, the kind of file your computer uses to render text on screen. Nothing about a font file raises alarms. That is precisely the point.
How does this attack actually reach someone?
It starts with a phishing email, meaning a fake message crafted to look like it came from a real, trusted company. In this case the criminals impersonate FedEx and similar shipping and logistics brands. The email looks routine, maybe a delivery update or a business cooperation request. An attachment comes with it.
When someone opens that attachment, a heavily scrambled JavaScript file (a type of code that websites and applications run) quietly installs itself on the machine and pulls down a second stage of the attack. That second stage drops two things: a legitimate interpreter program called LuaJIT or AutoIt (think of an interpreter as a small engine that can run scripts, similar to how a PDF reader runs PDF files) alongside the disguised font file, which actually contains encrypted malicious instructions.
The interpreter decrypts those instructions and runs them directly inside the computer's memory, without ever writing a recognisable malicious file to the hard drive. Antivirus software typically scans files on disk. No file on disk means far fewer opportunities to catch the attack.
The final payload is one of four malware families: Agent Tesla (a password-stealing tool), Remcos (software giving criminals remote control of your machine), XWorm (a similar remote-access tool), or Best Private Logger (a keylogger, meaning software that records every key you press).
As Shane Barney, chief information security officer at Keeper Security, noted in the original Dark Reading report: all of the elaborate evasion exists to survive detection after a human has already clicked. The obfuscation is downstream of the decision.
That framing matters for organisations thinking about defence. Blocking the email, or helping employees recognise a suspicious one, stops the attack before any of the clever technical tricks come into play. After that moment, the best protection is limiting what an attacker can actually reach: enforcing strict access controls so one stolen password does not open every system, requiring re-authentication for sensitive areas, and watching for unusual login patterns.
If you receive an unexpected email from a company you recognise, especially one asking you to open an attachment, confirm it through a separate channel before you do anything else. A quick phone call beats a slow incident response.
