# The TFF Trap: How BEC Attackers Learned to Be Invisible Before They Strike
Business email compromise has always been about trust exploitation — convincing someone with a keyboard and access to a wire transfer system that the request they just received is legitimate. But a technique researchers are calling "the TFF Trap" adds a layer that changes the game: by the time the fraud attempt lands in someone's inbox, attackers may already own the credentials that make it believable.
The campaign chains together fileless delivery, low-detection loaders, and a rotating menu of remote access trojans and credential stealers — Agent Tesla, Remcos, XWorm, and Best Private Logger — into a modular attack chain purpose-built to avoid triggering anything a corporate security stack would flag.
## Why Fileless Matters Here
Traditional malware needs to land somewhere. It touches the filesystem, writes an executable, maybe drops a DLL — and that's where most endpoint detection tools catch it. Fileless techniques sidestep this entirely by executing payloads in memory, often injecting code into legitimate processes like PowerShell, mshta.exe, or Windows Script Host. The disk never sees the malicious binary. Behavioral detection can catch it, but only if it's tuned correctly, which most enterprise deployments are not.
The TFF Trap layers fileless execution with loaders designed specifically to stay under detection thresholds. Loaders are the foot-in-the-door; their sole job is to retrieve and execute a payload without being seen. When researchers report "low detection rates," they mean these loaders were submitted to multi-engine scanning platforms and scored clean — or close enough to clean that automated defenses waved them through. That's not a misconfiguration on the defender's part. That's the attacker doing their job well.
## The Payload Menu
What makes this campaign notable is the breadth of what it delivers once it's inside:
Agent Tesla has been a fixture in BEC operations since at least 2014. It's a .NET-based keylogger and credential stealer that hoovers up browser-saved passwords, FTP credentials, VPN configs, and email client authentication. In BEC specifically, it gives attackers the account access needed to send fraudulent payment requests from legitimate addresses — the kind that actually work.
Remcos is nominally a commercial remote access tool sold as a legitimate product, but it's been weaponized extensively for corporate espionage and BEC enablement. Full remote desktop access, file management, keylogging, screen capture. Owning Remcos on a CFO's machine is owning the CFO's machine.
XWorm arrived on the threat landscape more recently and has shown up in campaigns targeting manufacturing and logistics — industries where invoice fraud is particularly lucrative. It supports lateral movement and can drop additional payloads, meaning it's often used as a beachhead for further infection.
Best Private Logger is the least-covered of the four but fits the same function: credential harvesting with an emphasis on staying quiet. The name is remarkably candid about its purpose.
What this payload diversity tells you is that the infrastructure is modular. The TFF Trap isn't a single-target campaign. The loader is the reusable investment; the payload is selected based on what's useful against a given target, or swapped when detections catch up to a specific variant.
## How This Enables Convincing BEC
Understanding why fileless malware appears in a BEC campaign requires understanding how modern BEC has evolved. Early BEC was blunt — spoof an executive's email address, ask for a wire transfer, hope someone complies. Security awareness training eventually blunted that approach.
Sophisticated BEC today requires account access. Sending a fraudulent payment instruction from inside the actual email thread it belongs in, from the actual compromised account of the actual executive or vendor, is a materially harder attack to detect. It passes SPF, DKIM, and DMARC checks. It looks indistinguishable from legitimate correspondence because it is legitimate correspondence — the body is fraudulent, the infrastructure is not.
Credential stealers like Agent Tesla and Best Private Logger are how attackers get that access. The phishing lure that delivers the TFF Trap isn't the BEC attempt itself — it's the reconnaissance phase. The fraud comes after.
## Defenders: The Gap You're Actually Facing
The low detection rates on the loaders are the most actionable detail here. If the payload drops clean in most scanning environments, signature-based endpoint detection is not going to save you. The controls that matter:
## HackWire Analysis
The TFF Trap represents something defenders should name clearly: a professionalization of the BEC supply chain. The attackers designing the loader are not necessarily the same people running the BEC fraud. Criminal marketplaces have matured to the point where a high-evasion loader with modular payload support is a product you buy, not a capability you build. This is why detection rates are low — they're low by design, the result of iterative testing against commercial AV engines that the attacker has access to before deployment.
What other coverage of this campaign is missing is the temporal logic. The malware deployment is not the attack — it's the setup. The window between initial compromise and BEC fraud attempt can be weeks or months. Attackers are patient. They read email, learn the payment processes, identify the right vendor relationships to impersonate or the right internal accounts to compromise before making a move. By the time the fraudulent invoice arrives, they understand the organization better than most of its own employees do.
This also makes detection harder in retrospect. When a company investigates a BEC fraud, they often find no trace of how the attacker knew so much — because the credential theft happened on an endpoint that IT never thought to forensically examine, using a payload that never wrote to disk.
The uncomfortable truth is that BEC at this sophistication level is not primarily an email security problem. It's an endpoint visibility problem, an authentication hygiene problem, and a process problem. Phishing-resistant MFA and behavioral endpoint detection are table stakes at this point. Organizations that haven't deployed them are financing the attacker's next campaign.
— HackWire Editorial
---
## Related Coverage