/
← Voltar ao feed
high

Global campaign uses obfuscated JScript droppers and a disguised .ttf Lua loader to deliver Snake Keylogger, Formbook and AgentTesla

1 fonte(s) · 1 atualização(ões) · publicado 16/07/2026 10:00 · coletado há 1 dia

FortiGuard Labs describes a large-scale, global campaign that uses heavily obfuscated JScript droppers to launch an AutoIt/Lua-based loader with low detection rates. The loader delivers several popular RATs and infostealers, including a version of Snake Keylogger. The infection chain relies on business email compromise tactics, impersonating trusted companies. The loader is updated regularly to evade detection and hinder analysis.

Technical Details

  • The dropped executable acts as a Lua/AutoIt interpreter. The core loader script is disguised with a .ttf extension, and it decrypts, loads and executes the next stage, which deploys the final malware.
  • Payloads named in the detections include Snake Keylogger, Formbook, AgentTesla and Donut (shellcode loader), plus Rescomms.
  • The lure observed is a double-extension file (.PDF.JS) hosted on the Discord CDN.
  • The article lists C2 infrastructure including 104.239.66.86:7004, 46.183.223.21:2404, 107.174.34.137:443 and newremupdate.duckdns.org:2404, along with several mail.* domains.
  • FortiGuard detections include PDF/Agent.A529!tr, JS/Formbook.PYN!tr, JS/Agent.UNU!tr, JS/Obfus.gen!tr, Data/Lua.9!tr, AutoIt/Autoit.OTS!tr, W64/Donut.E!tr, MSIL/AgentTesla.B!tr and MSIL/SnakeStealer.AVQ!tr.spy.

Remediation

  • Keep FortiGuard Antivirus protections up to date on FortiGate, FortiMail, FortiClient and FortiEDR.
  • Use FortiGuard CDR to disarm malicious content in documents.
  • Use FortiGuard IP Reputation and Anti-Botnet services.
  • Block or alert on the listed IOCs, and treat unexpected .JS attachments and double-extension files as malicious.
  • Train users on business email compromise lures.

Linha do tempo

  1. feeds.fortinet.com ↗ · pub. 16/07/2026 10:00 · coletado 19/10 18:02 primeiro registro

    Global campaign uses obfuscated JScript droppers and a disguised .ttf Lua loader to deliver Snake Keylogger, Formbook and AgentTesla

    ler a análise desta fonte

    FortiGuard Labs describes a large-scale, global campaign that uses heavily obfuscated JScript droppers to launch an AutoIt/Lua-based loader with low detection rates. The loader delivers several popular RATs and infostealers, including a version of Snake Keylogger. The infection chain relies on business email compromise tactics, impersonating trusted companies. The loader is updated regularly to evade detection and hinder analysis.

    Technical Details

    • The dropped executable acts as a Lua/AutoIt interpreter. The core loader script is disguised with a .ttf extension, and it decrypts, loads and executes the next stage, which deploys the final malware.
    • Payloads named in the detections include Snake Keylogger, Formbook, AgentTesla and Donut (shellcode loader), plus Rescomms.
    • The lure observed is a double-extension file (.PDF.JS) hosted on the Discord CDN.
    • The article lists C2 infrastructure including 104.239.66.86:7004, 46.183.223.21:2404, 107.174.34.137:443 and newremupdate.duckdns.org:2404, along with several mail.* domains.
    • FortiGuard detections include PDF/Agent.A529!tr, JS/Formbook.PYN!tr, JS/Agent.UNU!tr, JS/Obfus.gen!tr, Data/Lua.9!tr, AutoIt/Autoit.OTS!tr, W64/Donut.E!tr, MSIL/AgentTesla.B!tr and MSIL/SnakeStealer.AVQ!tr.spy.

    Remediation

    • Keep FortiGuard Antivirus protections up to date on FortiGate, FortiMail, FortiClient and FortiEDR.
    • Use FortiGuard CDR to disarm malicious content in documents.
    • Use FortiGuard IP Reputation and Anti-Botnet services.
    • Block or alert on the listed IOCs, and treat unexpected .JS attachments and double-extension files as malicious.
    • Train users on business email compromise lures.