Malware Disguised as Font Files Targets Windows Users
A global phishing campaign active since March 2026 is hiding credential-stealing malware inside fake font files, and the evasion chain is getting harder to catch.
Key points
- A global phishing campaign has been running since at least late March 2026, using fake font files to deliver malware.
- Malware families involved include Agent Tesla, Remcos, XWorm, and Best Private LOGGER.
- Attackers send phishing emails impersonating well-known companies, using business or payment themes as bait.
- The loader disguises itself as a TrueType Font file and executes malicious code entirely in memory, leaving no file on disk.
FortiGuard Labs researchers have found criminals hiding a Lua-based loader inside files with a .ttf extension, the format computers use to display text, then using it to drop password-stealing software and remote-access tools onto Windows machines. The campaign has run since at least late March 2026. We've tracked 86 malware stories in the last 90 days, including a July report on attackers using fake GitHub repositories to push similar credential-theft tools.
How did the hackers get in?
Phishing emails were the entry point. Criminals impersonated reputable companies, using business-cooperation or payment themes to lure recipients into opening compressed archive attachments. Those archives contain obfuscated JScript that drops either a legitimate AutoIt executable or a LuaJIT interpreter, along with the malicious script packaged inside a .ttf file. The fake font then runs several de-obfuscation steps before decrypting and executing shellcode directly in memory, so no payload ever touches the disk.
Shane Barney, CISO at Keeper Security, told CSO Online: "The most sophisticated technical evasion in the world still starts the same way: someone opens an email from what looks like a trusted company and acts on it." That's the uncomfortable truth this campaign keeps proving.
Should you worry?
Yes, especially if your organisation treats file extensions as proof of file type. Jason Soroko, senior fellow at Sectigo, warned that each component of the chain may look harmless in isolation, while the combined sequence leads to in-memory execution of the final payload. Newer variants raise the difficulty further, adding segmented shellcode encryption, bypasses for AMSI (a Windows feature that scans scripts for threats) and ETW (Windows event-tracing used by security tools), and API unhooking to strip away endpoint defences.
Both researchers are clear that detection based on file hashes or command-and-control addresses will fall short, because the loader has changed repeatedly. Soroko recommends restricting Windows Script Host and LuaJIT wherever they aren't operationally needed, and monitoring for behaviours like process injection and remote memory allocation rather than relying on static signatures. Barney's advice cuts to access controls: limit what any credential can reach, enforce least privilege, and require re-authentication for sensitive systems. Neither approach alone is sufficient.
