Attackers Combo Up Evasion Tactics for BEC Phishing
Attackers use fileless techniques and low-detection loaders to deploy RATs and stealers.
A new phishing campaign dubbed 'The TFF Trap' employs sophisticated evasion tactics, including fileless techniques and loaders designed to evade detection. These methods are used to deliver a variety of Remote Access Trojans (RATs) and stealers, such as Agent Tesla, Remcos, XWorm, and Best Private Logger, indicating a focus on credential harvesting and further network compromise.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe 'TFF Trap' campaign demonstrates how threat actors are layering multiple evasion techniques — including fileless execution and custom loaders — to slip past traditional security controls and deliver credential-harvesting malware. Because fileless attacks operate in memory rather than on disk, conventional antivirus and endpoint detection tools frequently fail to flag malicious activity before damage is done. The delivery of multiple RATs (Agent Tesla, Remcos, XWorm) suggests a well-resourced, adaptive adversary focused on persistent access and data exfiltration. This matters because Business Email Compromise (BEC) attacks enabled by stolen credentials can result in significant financial loss, regulatory exposure, and long-term network compromise. Organizations relying solely on perimeter defenses or signature-based detection are particularly vulnerable to this style of campaign.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Agent Tesla
- malware — Remcos
- malware — XWorm
- malware — Best Private Logger