[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDkXpmiuLeD51cwW0WZvpURD3In1TjVyS9m7DMGQJ5Jk":3},{"article":4,"iocs":38,"watch_terms":49,"solutions":50,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"29714542-5634-4ad7-a287-61f084da446e","Attackers Combo Up Evasion Tactics for BEC Phishing","attackers-combo-up-evasion-tactics-for-bec-phishing-a42216","\"The TFF Trap\" uses fileless techniques and loaders with low detection rates to deploy various RATs and stealers, including Agent Tesla, Remcos, XWorm, and Best Private Logger.","A new phishing campaign dubbed 'The TFF Trap' employs sophisticated evasion tactics, including fileless techniques and loaders designed to evade detection. These methods are used to deliver a variety of Remote Access Trojans (RATs) and stealers, such as Agent Tesla, Remcos, XWorm, and Best Private Logger, indicating a focus on credential harvesting and further network compromise.","Attackers use fileless techniques and low-detection loaders to deploy RATs and stealers.","https:\u002F\u002Fwww.darkreading.com\u002Fendpoint-security\u002Fattackers-combo-evasion-tactics-bec-phishing","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt2bb343e182f4af3e\u002F6a5e0b48c714ec6091e7ebc7\u002FPhishing_ronstik_Alamy.jpg?width=720&quality=80&disable=upscale","2026-07-20T18:30:22+00:00","2026-07-20T20:00:14.650019+00:00",7,[17],{"name":18,"type":19},"TFF Trap","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[39,42,45,47],{"type":24,"value":40,"context":41},"Agent Tesla","Stealer malware deployed by TFF Trap campaign",{"type":24,"value":43,"context":44},"Remcos","RAT malware deployed by TFF Trap campaign",{"type":24,"value":46,"context":44},"XWorm",{"type":24,"value":48,"context":41},"Best Private Logger",[],{"controls":51,"vendors":136},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":82,"name":83,"problem":84,"products":85},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"slug":111,"name":112,"problem":113,"products":114},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[115,121,129],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":117,"url":119,"description":120},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":133,"url":134,"description":135},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":155},"fileless-phishing-campaign-bypasses-defenses-to-deploy-rats-and-stealers","Fileless Phishing Campaign Bypasses Defenses to Deploy RATs and Stealers","The 'TFF Trap' campaign demonstrates how threat actors are layering multiple evasion techniques — including fileless execution and custom loaders — to slip past traditional security controls and deliver credential-harvesting malware. Because fileless attacks operate in memory rather than on disk, conventional antivirus and endpoint detection tools frequently fail to flag malicious activity before damage is done. The delivery of multiple RATs (Agent Tesla, Remcos, XWorm) suggests a well-resourced, adaptive adversary focused on persistent access and data exfiltration. This matters because Business Email Compromise (BEC) attacks enabled by stolen credentials can result in significant financial loss, regulatory exposure, and long-term network compromise. Organizations relying solely on perimeter defenses or signature-based detection are particularly vulnerable to this style of campaign.",[142,143,144,145,146,147,148,149,150,151,152,153,154],"CIS Control 9 – Email and Web Browser Protections","CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 IA-5 – Authenticator Management (MFA)","NIST CSF DE.CM-1 – Network Monitoring","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1059 – Command and Scripting Interpreter (Fileless)","MITRE ATT&CK T1055 – Process Injection","GDPR Article 32 – Security of Processing (breach risk mitigation)",{}]