Loading story…
Palo Alto Networks Unit 42 published a technical analysis of FalseFont, a backdoor linked to the threat actor Curious Serpens, detailing how the malware is used in targeted intrusions and outlining its capabilities, detection opportunities, and defensive measures. The report attributes the activity to a named threat cluster and frames FalseFont as a key tool in the actor’s post-compromise operations.
The analysis focuses on how defenders can identify and prevent FalseFont-related activity, including malware behaviors, indicators, and mitigation guidance intended to help security teams strengthen monitoring and response. The publication adds to public reporting on Curious Serpens by providing technical detail that CISOs and security operations teams can use to improve threat hunting, detection engineering, and incident readiness against this backdoor.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published a technical analysis of the FalseFont backdoor attributed to Curious Serpens, including detection and prevention guidance. No earlier incident dates are provided in the reference metadata, so the publication date is used as the event date.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A global phishing campaign dubbed **TTF Trap** is using business email compromise lures and impersonation of trusted brands such as **FedEx** to infect **Windows** users with remote access Trojans and infostealers. Fortinet said the operation begins with phishing emails carrying or linking to ZIP or RAR archives, then launches heavily obfuscated JavaScript that establishes persistence and triggers a disguised loader hidden inside a fake `.ttf` font file. The loader runs through legitimate **LuaJIT** or **AutoIt** interpreters and uses layered obfuscation, in-memory execution, API unhooking, anti-analysis checks, and reflective loading to avoid detection while keeping payloads off disk. Researchers observed the campaign since late March and said related loader code dates back to October 2025; malware delivered in the operation includes **Agent Tesla**, **Remcos**, **XWorm**, **Best Private Logger**, and **Snake Keylogger** variants, with the apparent goal of stealing data and maintaining remote access for follow-on attacks.
Jul 22, 2026
ESET disclosed a previously unknown Linux malware family dubbed **FontOnLake** that appears built for targeted intrusions. The malware is modular and includes trojanized applications, backdoors, and rootkits that give attackers remote access, steal credentials and Bash history, execute arbitrary shell commands and Python scripts, and turn compromised hosts into proxies. Researchers said the toolkit abuses modified legitimate Linux binaries including `cat`, `kill`, `sftp`, and `sshd` to load components and maintain persistence. FontOnLake stands out for combining userland malware with a rootkit that hides files, processes, and network connections, complicating detection on infected systems. ESET also observed command-and-control infrastructure using unique servers on non-standard ports, while analyzed samples appeared tailored for distributions such as **CentOS** and **Debian**. The first known sample was uploaded to VirusTotal in May 2021, and upload patterns and C2 locations suggested possible targeting in Southeast Asia, although the initial infection vector was still unknown.
Aug 14, 2026
Researchers reported a large-scale phishing campaign targeting Windows users with malicious archives that masquerade as business cooperation or payment-related documents from well-known companies. The infection chain uses heavily obfuscated JScript droppers and an AutoIt- or Lua-based loader disguised as a TrueType font (`.ttf`) file, enabling a largely fileless compromise path designed to avoid detection. Security reporting described the operation as global in scope, with lures crafted to persuade recipients to open fake font files that trigger the malware delivery process. The campaign has deployed multiple commodity malware families, including **Agent Tesla**, **Remcos**, **XWorm**, and **Best Private LOGGER**, the latter assessed as a variant of **Snake Keylogger** based on shared modules and coding patterns. Researchers said the loader evolved significantly from late 2025 through mid-2026, adding anti-analysis features such as junk code, string obfuscation, API unhooking, breakpoint neutralization, Donut shellcode signature patching, decoy memory, and segmented shellcode decryption through a Vectored Exception Handler. Published indicators include domains, IP addresses, a Discord-hosted malicious JavaScript file, and SHA-256 hashes to support enterprise detection and threat hunting.
Jul 17, 2026