The TTF Trap: A Global Campaign of a Low-Detection Lua Loader

Reported 16 Jul 2026 by otx · Severity: medium

Since late March 2026, a large-scale phishing campaign has been deploying malware including Agent Tesla, Remcos, XWorm, and Best Private LOGGER through fileless techniques and low-detection Lua-based loaders. Attackers impersonate well-known companies using business cooperation l