Loading malware…
Agent Tesla is a long-running Windows credential-stealing malware family widely used in commodity cybercrime campaigns and commonly classified as a remote access trojan, though its observed behavior also overlaps strongly with infostealers and keyloggers. It is frequently delivered through phishing and malspam campaigns using business-themed lures such as invoices, orders, payment notices, requests, and shipping or corporate correspondence, often via compressed attachments, script-based droppers, batch files, or multi-stage loaders. It has also been observed as a payload delivered by third-party loaders, crypters, and malware distribution services including Lua- and AutoIt-based fileless chains, GuLoader, Cruciferra, and Amadey-linked ecosystems.
On compromised Windows systems, Agent Tesla is used primarily for information theft and surveillance. Reported capabilities include keylogging, theft of saved credentials from Chromium-based browsers and Mozilla-family applications, collection of credentials from Windows Credential Vault, clipboard monitoring, screenshot capture, host fingerprinting, and discovery of running processes and system details. Some analyzed samples also contain code associated with cookie collection, contact access, directory traversal, and email-based packaging of stolen data for exfiltration. Exfiltration is commonly performed over SMTP, a hallmark repeatedly observed across campaigns.
Agent Tesla campaigns often rely on multi-stage execution chains designed to reduce detection. Observed tradecraft includes obfuscated batch, PowerShell, JScript, AutoIt, and Lua loader stages; in-memory shellcode execution; process injection into legitimate Windows processes; dynamic API resolution; string obfuscation; anti-debugging; anti-sandbox and anti-virtual-machine checks; and AMSI-related tampering. Persistence has been observed through Windows Registry modification, Scheduled Tasks, and Startup-folder mechanisms. Injection into legitimate processes has been documented as a final-stage execution method in some campaigns.
The malware is broadly opportunistic and has been seen targeting enterprises and individual users across multiple sectors and geographies, including financial services, healthcare, government, hospitality, travel, and regional business users in Europe and Asia. It is commonly associated with financially motivated threat activity rather than a single exclusive operator, and it regularly appears alongside other commodity malware families such as Remcos, FormBook, XWorm, AsyncRAT, LokiBot, and Snake Keylogger variants in shared delivery ecosystems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Instead of relying solely on exploiting unpatched document software as seen in past campaigns that heavily abused known Microsoft Office flaws such as CVE-2017-11882, CVE-2017-0199, and CVE-2018-0802, modern operators are utilizing highly deceptive script-based loaders. | In a recently observed attack, a routine-looking phishing email quietly triggered a full-scale malware compromise, showcasing an advanced Agent Tesla infection chain.
Instead of relying solely on exploiting unpatched document software as seen in past campaigns that heavily abused known Microsoft Office flaws such as CVE-2017-11882, CVE-2017-0199, and CVE-2018-0802, modern operators are utilizing highly deceptive script-based loaders. | In a recently observed attack, a routine-looking phishing email quietly triggered a full-scale malware compromise, showcasing an advanced Agent Tesla infection chain.
Instead of relying solely on exploiting unpatched document software as seen in past campaigns that heavily abused known Microsoft Office flaws such as CVE-2017-11882, CVE-2017-0199, and CVE-2018-0802, modern operators are utilizing highly deceptive script-based loaders. | In a recently observed attack, a routine-looking phishing email quietly triggered a full-scale malware compromise, showcasing an advanced Agent Tesla infection chain.
Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery. | Agent Tesla can collect account information from the victim’s machine. Agent Tesla has used HTTP for C2 communications. Agent Tesla has used SMTP for C2 communications.
...finally deploying stealer and cryptominer malware such as AgentTesla, rhajk, nasqa.
Associated Analytic Story AgentTesla CVE-2023-21716 Word RTF Heap Corruption Compromised Windows Host FIN7 PlugX Warzone RAT
...finally deploying stealer and cryptominer malware such as AgentTesla, rhajk, nasqa.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
[👽TA] TA558 (🏴): Steganography using other malwares (AgentTesla, FormBook, Remcos, LokiBot, GuLoader or XWorm)
beginning in late 2021, Proofpoint observed this group begin using DiscordApp URLs linking to a compressed file which led to either AgentTesla or Imminent Monitor.
The info stealers most popular with SilverTerrier last year were LokiBot (446 unique samples/month), Pony (330 unique samples/month), and Agent Tesla .NET keylogger (95 unique samples/month).
The group relied exclusively on a variety of publicly available spyware and Remote Access Trojans (RATs), including AgentTesla, Lokibot, AzoRult, Pony, and NetWire.
...finally deploying stealer and cryptominer malware such as AgentTesla, rhajk, nasqa.
"...families of RATs and infostealers. These included Lokibot, Betabot, Formbook, and AgentTesla."
36 distinct techniques documented for this family, organized by ATT&CK tactic.
Since late March 2026, researchers have observed large-scale phishing campaigns that use fileless techniques and Lua-based loaders with low detection rates to deliver malware such as Agent Tesla, Remcos, XWorm, and Best Private LOGGER.
The command launches PowerShell in a minimized and hidden window... uses Invoke-RestMethod (irm) to download a remote script... immediately executed in memory through Invoke-Expression (iex).
Figure 3 above shows a heavily obfuscated Windows Batch (.bat) script designed to conceal its actual functionality and evade detection.
During later stages, the malware establishes persistence by dropping several components into the system’s temporary directory and placing an additional Batch script in the Windows Startup folder to ensure execution after system reboots.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
During later stages, the malware establishes persistence by dropping several components into the system’s temporary directory and placing an additional Batch script in the Windows Startup folder to ensure execution after system reboots.
the loader injects the Agent Tesla payload into the legitimate Windows process charmap.exe using remote memory allocation and CreateRemoteThread execution
The first-stage batch script employs multiple layers of obfuscation to conceal its true functionality and evade static detection.
the loader injects the Agent Tesla payload into the legitimate Windows process charmap.exe using remote memory allocation and CreateRemoteThread execution
It then uses Windows API functions such as OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread to allocate memory, inject the decrypted payload, and execute it within the remote process.
After successfully sending the data, the malware disposes of the attachments and memory streams to remove traces of the transferred information.
It contains a Base64-encoded payload that is decoded and XOR-decrypted using the key 0xC8.
The decoded command revealed that ljers.exe was being executed... Further analysis of ljers.exe revealed that it is actually AutoIt3.exe, the legitimate AutoIt interpreter used to execute AutoIt scripts line-by-line at runtime.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The Grab() method accesses the Windows Vault API to enumerate stored credentials and retrieve sensitive login information such as website addresses, usernames, and passwords.
We also see how the malware is using hooks to inject into different processes to capture and compare data.
Functions such as GetForegroundWindow, GetWindowText, and GetKeyboardState indicate that the program is capable of capturing active window information and keyboard input.
the malware also contains a system fingerprinting routine... and the victim’s public IP address.
The malware goes through a discovery stage where it identifies current windows processes and threads that are active.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
Best Private LOGGER appears to be a modified version of an older Snake Keylogger... combined with the data it harvests from the victim.
We also see how the malware is using hooks to inject into different processes to capture and compare data.
Functions such as GetForegroundWindow, GetWindowText, and GetKeyboardState indicate that the program is capable of capturing active window information and keyboard input.
The code contains hardcoded SMTP settings, including the mail server address, sender account, receiver account, and authentication credentials used for data transmission.
Both lured recipients into opening executable files through compressed attachments and used SMTP to transmit information.
917 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Credential-stealing malware delivered by the Lua-based loader in the phishing campaign.
A malware payload family observed being delivered by Cruciferra.
Payload deployed in the campaign as one of several RATs/infostealers; these payloads grant the attacker remote administrative control and enable data exfiltration from compromised systems.
A credential-stealing malware/RAT identified in phishing emails masquerading as business messages; recipients were enticed to open executables from compressed attachments, and stolen information was sent via SMTP.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.