Loading story…
ESET disclosed a previously unknown Linux malware family dubbed FontOnLake that appears built for targeted intrusions. The malware is modular and includes trojanized applications, backdoors, and rootkits that give attackers remote access, steal credentials and Bash history, execute arbitrary shell commands and Python scripts, and turn compromised hosts into proxies. Researchers said the toolkit abuses modified legitimate Linux binaries including cat, kill, sftp, and sshd to load components and maintain persistence.
FontOnLake stands out for combining userland malware with a rootkit that hides files, processes, and network connections, complicating detection on infected systems. ESET also observed command-and-control infrastructure using unique servers on non-standard ports, while analyzed samples appeared tailored for distributions such as CentOS and Debian. The first known sample was uploaded to VirusTotal in May 2021, and upload patterns and C2 locations suggested possible targeting in Southeast Asia, although the initial infection vector was still unknown.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
ESET reported that the first known file associated with the previously unknown Linux malware family later named FontOnLake appeared on VirusTotal. Additional samples were uploaded throughout the same year.
ESET researchers publicly described a previously unknown Linux malware family they named FontOnLake, assessing it as advanced, stealthy, and likely used in targeted attacks. The report detailed its modular use of trojanized applications, backdoors, and rootkits, with possible targeting in Southeast Asia.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 41 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A global phishing campaign dubbed **TTF Trap** is using business email compromise lures and impersonation of trusted brands such as **FedEx** to infect **Windows** users with remote access Trojans and infostealers. Fortinet said the operation begins with phishing emails carrying or linking to ZIP or RAR archives, then launches heavily obfuscated JavaScript that establishes persistence and triggers a disguised loader hidden inside a fake `.ttf` font file. The loader runs through legitimate **LuaJIT** or **AutoIt** interpreters and uses layered obfuscation, in-memory execution, API unhooking, anti-analysis checks, and reflective loading to avoid detection while keeping payloads off disk. Researchers observed the campaign since late March and said related loader code dates back to October 2025; malware delivered in the operation includes **Agent Tesla**, **Remcos**, **XWorm**, **Best Private Logger**, and **Snake Keylogger** variants, with the apparent goal of stealing data and maintaining remote access for follow-on attacks.
Jul 22, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Researchers reported a large-scale phishing campaign targeting Windows users with malicious archives that masquerade as business cooperation or payment-related documents from well-known companies. The infection chain uses heavily obfuscated JScript droppers and an AutoIt- or Lua-based loader disguised as a TrueType font (`.ttf`) file, enabling a largely fileless compromise path designed to avoid detection. Security reporting described the operation as global in scope, with lures crafted to persuade recipients to open fake font files that trigger the malware delivery process. The campaign has deployed multiple commodity malware families, including **Agent Tesla**, **Remcos**, **XWorm**, and **Best Private LOGGER**, the latter assessed as a variant of **Snake Keylogger** based on shared modules and coding patterns. Researchers said the loader evolved significantly from late 2025 through mid-2026, adding anti-analysis features such as junk code, string obfuscation, API unhooking, breakpoint neutralization, Donut shellcode signature patching, decoy memory, and segmented shellcode decryption through a Vectored Exception Handler. Published indicators include domains, IP addresses, a Discord-hosted malicious JavaScript file, and SHA-256 hashes to support enterprise detection and threat hunting.
Jul 17, 2026