As cited
Copy frozen at (site build).
threat intel
Phishing Campaign Hides Lua Loader as TrueType Font File
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Phishing Campaign Hides Lua Loader as TrueType Font File
A widespread phishing campaign embeds a Lua-based loader within TrueType font files to distribute remote access trojans (RATs) and information stealing malware. Attackers use file format obfuscation to evade detection and deliver multiple payload types to compromised systems.
Why it matters: Organizations and users are targeted by this campaign; practitioners should monitor for suspicious font file execution and block Lua interpreters in email attachments or unexpected contexts to prevent RAT and infostealer deployment.
- Source published
- First seen by Cybersecurity Tracker