AgentTesla v3 Phishing Chain Used Five-Stage JavaScript Loader and SMTP Exfiltration

Breakglass Intelligence reported a credential-stealing campaign delivering AgentTesla v3 through spear-phishing emails masquerading as purchase orders or request-for-quote documents. The infection chain used a heavily obfuscated JavaScript or JScript attachment that launched XOR-decrypted PowerShell, reflectively loaded a .NET component identified as DEV.dll, and performed process hollowing into aspnet_compiler.exe to run the final payload. The malware established persistence through %APPDATA%\GLOZVJ\GLOZVJ.exe, a Startup shortcut, and an HKCU\Run value named GLOZVJ, while a watchdog loop re-injected the payload if the host process was terminated.

The payload harvested credentials and data from more than 40 browsers, over 20 email clients, FTP and VPN software, Discord tokens, Windows Credential Manager, clipboard contents, screenshots, and keystrokes, then exfiltrated the data over SMTP through mail.cottondreams.org on a Ukrainian VPS at 31.222.235.198. Reports said the server used Exim, Dovecot, nginx, OpenSSH, ProFTPD, and FASTPANEL, and that plaintext SMTP credentials and weak certificate hygiene exposed poor operator security. Breakglass linked the infrastructure to activity dating back to domain registration in March 2024 and related samples seen since January 2025, assessing the operation as a persistent, financially motivated AgentTesla MaaS campaign with possible overlap with West African BEC-style tradecraft.