Multi-Stage Agent Tesla Campaign Uses Script Loaders and Process Hollowing

Researchers detailed a phishing-led Agent Tesla infection chain that starts with a payment-receipt-themed email attachment and escalates through multiple scripted stages to full compromise. The campaign avoids older Office exploit techniques such as CVE-2017-11882, CVE-2017-0199, and CVE-2018-0802, instead relying on heavily obfuscated Batch and PowerShell loaders to launch payloads in memory, execute hidden scripts, and establish persistence while reducing visibility to traditional defenses.

The final VB.NET payload uses anti-debugging, anti-sandbox, and anti-VM checks before performing process hollowing into legitimate Windows binaries such as charmap.exe. Once active, Agent Tesla steals browser credentials, cookies, autofill data, keystrokes, and screenshots, then exfiltrates the data over channels including SMTP, FTP, and Telegram bots, highlighting the threat posed by fileless execution and in-memory process injection in commodity malware campaigns.