A large-scale phishing operation has been observed disguising a malicious script as a TrueType font file (.tff). Using the fake .ttf extension, a Lua-based loader is slipped onto Windows systems and a rotating cast of remote access trojans and infostealers is deployed. According to research published on July 16 by Fortinet's FortiGuard Labs, the campaign has been running since late March 2026 and combines fileless techniques with a low-detection loader to deliver Agent Tesla, Remcos, XWorm and a keylogger called Best Private LOGGER. The operators impersonated well-known companies and used business-cooperation lures to push malicious archives, often attached to phishing emails carrying payment-themed prompts. Fake Fonts, Real Loaders The archives observed by Fortinet contained a JavaScript…