Global campaign uses obfuscated JScript droppers and a disguised .ttf Lua loader to deliver Snake Keylogger, Formbook and AgentTesla
FortiGuard Labs describes a large-scale, global campaign that uses heavily obfuscated JScript droppers to launch an AutoIt/Lua-based loader with low detection rates. The loader delivers several popular RATs and infostealers, including a version of Snake Keylogger. The infection chain relies on business email compromise tactics, impersonat…