AgentTesla Phishing Campaign Uses Obfuscated JScript Droppers and Firebase-Staged PowerShell

Researchers analyzed multiple AgentTesla infection chains that begin with heavily obfuscated JScript files executed by wscript.exe, often delivered as phishing attachments and, in one case, an RFQ-themed spear-phishing lure named "RFQ No 600002389875 RG724.JS". The scripts used layered evasion including centralized string arrays, index arithmetic, control-flow flattening, junk code, string reversal, delimiter noise, and a regex-based anti-debugging technique. In the Firebase-backed variant, the dropper retrieved a second-stage PowerShell payload from a Google Firebase Storage bucket, saved it to C:\Temp\ under a randomized filename, and launched it with execution-policy bypass and hidden-window options, allowing malicious traffic to blend with trusted Google infrastructure.

A related loader variant dropped PE payloads disguised as .png files into C:\Users\Public\, executed PowerShell in memory through a base64-decoded IEX command, and established persistence via the HKCU\Run registry key. The activity was linked to commodity cybercrime and the AgentTesla credential-theft family, which is commonly associated with credential harvesting, keylogging, screenshot capture, and data exfiltration over SMTP, FTP/FTPS, or HTTP/HTTPS. Detection remained relatively low across samples, with reports citing 14/76 and 20/76 antivirus detections at initial analysis, underscoring the effectiveness of the campaign’s obfuscation and abuse of legitimate cloud services.