Would this perhaps be a tracking ability, as described at https://panopticlick.eff.org (specifically, the list of "System Fonts")
It would require the users to visit a site that is collecting this tracking information, but it isn't impossible to imagine a popular site among the target audience being strong-armed by a nation-state into installing something to do this.
The tracking is practically invisible to end users.
[1] http://blog.crysys.hu/2012/08/on-the-palida-narrow-mystery-o...
Do we have to repeat the same debate about this one's origin?
Kaspersky tends to exaggerate how novel these viruses are.
Yuk Yuk Yuk - I wonder what is going on with this then!
Trying to remember the last time I didn't read about some ultra-dooper-al-quaeda-cyber-virus. Seems any kid with a C compiler these days pumping out cutpasted code qualifies as a complex threat.
Coming up: 50 page white paper on the seemingly "innocuous" font (translation: obviously some previously unknown 0day secret intelligence 007 cyber warhead) and its implications for national security funding.
But of course not, obviously it's Al Quaeda. How else will the security industry succeed in strangling more cash and evil, preferential, freedom-damaging policies from central government?
Well, at least we have a shortlist then. UK, Iceland, Greece, Spain...
Advanced Persistent Phish? - Is that some kind of really annoying halibut, armed with lasers?