TFF Trap phishing campaign spreads Agent Tesla, Remcos filelessly

The article discusses a phishing campaign named "The TFF Trap" that employs sophisticated evasion tactics to deliver various remote access Trojans (RATs) and info stealers, such as Agent Tesla and Remcos. Attackers impersonate familiar companies to gain initial access through Business Email Compromise (BEC). They utilize fileless techniques, disguising malware delivery as font files and executing code directly in memory to evade detection.

The campaign targets Microsoft Windows systems, aiming to exploit stolen data for further attacks. Experts emphasize the importance of robust identity and access controls to mitigate risks and recommend educating employees to be cautious of unusual requests from known contacts.