THREATOPS

THREAT OPS › Threat News › The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

lowfortinet_researchPublished 2026-07-16

<p>FortiGuard Labs analyzes a global phishing campaign using obfuscated JScript, disguised .ttf files, and Lua loaders to deliver RATs and infostealers.</p><img align="left" alt="" border="0" height="1" hspace="0" src="https://feeds.fortinet.com/~/i/960560447/0/fortinet/blog/threat-research" style="border: 0; float: left; margin: 0; padding: 0; width: 1px!important; height: 1px!important;" width="

Indicators of compromise

assets.feedblitz.comdomain

Original source: https://feeds.fortinet.com/~/960560447/0/fortinet/blog/threat-research~The-TTF-Trap-A-Global-Campaign-of-a-LowDetection-Lua-Loader