Best Private LOGGER

A large-scale phishing operation has been observed disguising a malicious script as a TrueType font file (.tff).

The operators impersonated well-known companies and used business-cooperation lures to push malicious archives, often attached to phishing emails carrying payment-themed prompts.

Others link out to one.

Instead of dropping a conventional executable, however, the malware deploys a legitimate LuaJIT or AutoIt interpreter alongside a file disguised as .ttf that actually contains encrypted Lua bytecode.

The attack chain is set in motion when a would-be victim executes an email attachment that comes in the form of a heavily obfuscated JavaScript that, when executed, establishes persistence on the victim's system and launches a second-stage loader.

Instead of dropping a conventional executable, however, the malware deploys a legitimate LuaJIT or AutoIt interpreter alongside a file disguised as .ttf that actually contains encrypted Lua bytecode.

the campaign has been running since late March 2026 and combines fileless techniques with a low-detection loader... while the combined sequence produced in-memory execution of RATs and infostealers.

Inside the archive sits an obfuscated JavaScript file. It hides in heavy junk code and uses control-flow flattening to defeat analysis.

The name comes from attackers' use of a TrueType Font (.ttf) file to hide the AutoIT/Lua loader used to deliver malware.

the campaign has been running since late March 2026 and combines fileless techniques with a low-detection loader... while the combined sequence produced in-memory execution of RATs and infostealers.

This disguised loader decrypts, loads, and executes the subsequent stage, which ultimately deploys the malware.

The final payload arrived wrapped in Donut shellcode, whose reflective loader mapped and executed the malware directly in memory, leaving nothing on disk to inspect.

Best Private LOGGER appears to be a modified version of an older Snake Keylogger.

Best Private LOGGER appears to be a modified version of an older Snake Keylogger... combined with the data it harvests from the victim.

Best Private LOGGER appears to be a modified version of an older Snake Keylogger.

The interpreter then decrypts and executes the malicious code directly in memory, where it performs additional anti-analysis checks, unhooks Windows APIs that may be monitored by endpoint security tools...