Agent Tesla

PureLogs, PureRAT and misleading zgRAT

Security researchers and email threat monitors reported continued activity from the PureCoder malware ecosystem, with campaigns distributing credential-stealing and remote-access payloads including PureLogs, PureRAT, and PureHVNC. An analysis of the broader Pure malware family described it as a growing threat, while Italian malspam telemetry later showed PureHVNC appearing alongside AgentTesla, FormBook, and Remcos in business-themed phishing lures tied to bank transfers, orders, offers, and requests. Script files were the most common attachment type in those campaigns, followed by Office documents and MSIL binaries. Researchers also warned that industry naming around this malware remains inconsistent, especially the use of zgRAT to describe different PureCoder families. Netresec said the label is being applied to both PureLogs, a .NET infostealer focused on credential and data theft, and PureRAT, a .NET RAT that supports capabilities such as HVNC, webcam and microphone access, keylogging, reverse proxying, and code injection. The report said this overlap affects Suricata and TLS-certificate-based detections, creating false positives and family-level misclassification, and urged defenders to use precise names such as PureLogs or PureRAT when attribution is clear.

TTF Trap: Fake Font Files Hide a Stealthy Lua Loader

A global phishing campaign dubbed TTF Trap is using business email compromise lures and impersonation of trusted brands such as FedEx to infect Windows users with remote access Trojans and infostealers. Fortinet said the operation begins with phishing emails carrying or linking to ZIP or RAR archives, then launches heavily obfuscated JavaScript that establishes persistence and triggers a disguised loader hidden inside a fake .ttf font file. The loader runs through legitimate LuaJIT or AutoIt interpreters and uses layered obfuscation, in-memory execution, API unhooking, anti-analysis checks, and reflective loading to avoid detection while keeping payloads off disk. Researchers observed the campaign since late March and said related loader code dates back to October 2025; malware delivered in the operation includes Agent Tesla, Remcos, XWorm, Best Private Logger, and Snake Keylogger variants, with the apparent goal of stealing data and maintaining remote access for follow-on attacks.

This $2,000-a-Month Crypter Can Kill EDR and Make Malware Disappear From Disk

Proofpoint reported that the Cruciferra crypter-as-a-service is being used by multiple unrelated cybercriminal actors to deliver commodity malware, particularly RATs and infostealers, through email-borne campaigns. Marketed since fall 2025 on exploit[.]in with subscription tiers ranging from $450 to $2,000 per month, the service has been tied to campaigns distributing AsyncRAT, XWorm, zgRAT, Agent Tesla, Formbook, XLoader, Phantom Stealer, and Remcos. Financial services, healthcare, and government organizations appeared frequently among targets, while observed lures included tax-themed messages linked to TA4922 and hospitality-themed campaigns delivering zgRAT. Researchers said Cruciferra is under active development, with both production and testing variants observed and VirusTotal metadata indicating frequent rebuilds and redeployment. The crypter, written in Mono, combines layered evasion and anti-analysis techniques including DLL side-loading, decoy exports, indirect syscalls, API and IAT unhooking, BYOVD-based EDR tampering, persistence, UAC bypass, and a customized Process Ghosting implementation, alongside more than 90 custom or hybrid cryptographic routines designed to conceal payloads and hinder static analysis. Microsoft documentation on the COM Elevation Moniker provides context for one of the Windows privilege-elevation mechanisms relevant to the UAC bypass tradecraft described in the analysis.

Sophisticated crypter service Cruciferra evades detection with advanced techniques | brief | SC Media

Unpacking “Cruciferra”: An Analysis of a Sophisticated Crypter Service | Community Portal | Gurucul

Attackers Combo Up Evasion Tactics for BEC Phishing

The TTF Trap: A Global Campaign of a Low-Detection Lua Loader | Community Portal | Gurucul

Researchers reported a large-scale phishing campaign targeting Windows users with malicious archives that masquerade as business cooperation or payment-related documents from well-known companies. The infection chain uses heavily obfuscated JScript droppers and an AutoIt- or Lua-based loader disguised as a TrueType font (.ttf) file, enabling a largely fileless compromise path designed to avoid detection. Security reporting described the operation as global in scope, with lures crafted to persuade recipients to open fake font files that trigger the malware delivery process. The campaign has deployed multiple commodity malware families, including Agent Tesla, Remcos, XWorm, and Best Private LOGGER, the latter assessed as a variant of Snake Keylogger based on shared modules and coding patterns. Researchers said the loader evolved significantly from late 2025 through mid-2026, adding anti-analysis features such as junk code, string obfuscation, API unhooking, breakpoint neutralization, Donut shellcode signature patching, decoy memory, and segmented shellcode decryption through a Vectored Exception Handler. Published indicators include domains, IP addresses, a Discord-hosted malicious JavaScript file, and SHA-256 hashes to support enterprise detection and threat hunting.

Fake TTF files deliver stealthy malware in global phishing campaign | CSO Online