Loading story…
Researchers detailed a phishing-led Agent Tesla infection chain that starts with a payment-receipt-themed email attachment and escalates through multiple scripted stages to full compromise. The campaign avoids older Office exploit techniques such as CVE-2017-11882, CVE-2017-0199, and CVE-2018-0802, instead relying on heavily obfuscated Batch and PowerShell loaders to launch payloads in memory, execute hidden scripts, and establish persistence while reducing visibility to traditional defenses.
The final VB.NET payload uses anti-debugging, anti-sandbox, and anti-VM checks before performing process hollowing into legitimate Windows binaries such as charmap.exe. Once active, Agent Tesla steals browser credentials, cookies, autofill data, keystrokes, and screenshots, then exfiltrates the data over channels including SMTP, FTP, and Telegram bots, highlighting the threat posed by fileless execution and in-memory process injection in commodity malware campaigns.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Point Wild published analysis of a recently observed Agent Tesla phishing campaign that used a payment-receipt-themed lure, obfuscated Batch and PowerShell loaders, in-memory execution, persistence, and process hollowing into a legitimate process. The report also described anti-debugging and anti-VM checks and theft of credentials, cookies, keystrokes, screenshots, and other data for exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzed multiple **AgentTesla** infection chains that begin with heavily obfuscated **JScript** files executed by `wscript.exe`, often delivered as phishing attachments and, in one case, an RFQ-themed spear-phishing lure named **"RFQ No 600002389875 RG724.JS"**. The scripts used layered evasion including centralized string arrays, index arithmetic, control-flow flattening, junk code, string reversal, delimiter noise, and a regex-based anti-debugging technique. In the Firebase-backed variant, the dropper retrieved a second-stage PowerShell payload from a **Google Firebase Storage** bucket, saved it to `C:\Temp\` under a randomized filename, and launched it with execution-policy bypass and hidden-window options, allowing malicious traffic to blend with trusted Google infrastructure. A related loader variant dropped PE payloads disguised as `.png` files into `C:\Users\Public\`, executed PowerShell in memory through a base64-decoded `IEX` command, and established persistence via the **`HKCU\Run`** registry key. The activity was linked to commodity cybercrime and the **AgentTesla** credential-theft family, which is commonly associated with credential harvesting, keylogging, screenshot capture, and data exfiltration over **SMTP**, **FTP/FTPS**, or **HTTP/HTTPS**. Detection remained relatively low across samples, with reports citing **14/76** and **20/76** antivirus detections at initial analysis, underscoring the effectiveness of the campaign’s obfuscation and abuse of legitimate cloud services.
Jun 29, 2026
**Agent Tesla** continued to appear in phishing-led intrusion chains that used malicious Office documents, ISO attachments, JavaScript, VBScript, and NSIS-based loaders to infect Windows systems and deploy the .NET infostealer in memory. Multiple reports described delivery through macro-enabled purchase-order lures, DHL-themed malspam, and droppers that abused `certutil.exe`, `mshta`, and spoofed or cybersquatted infrastructure such as `diodetechs[.]com`. Researchers also documented layered packing and concealment methods including oversized padded executables, embedded bitmap and PNG resources, reversed payloads, XOR and compression routines, and steganography that hid intermediate DLLs or final payloads inside image files before injection into processes such as `MSBuild.exe`. Once installed, Agent Tesla established persistence through **Run registry keys**, scheduled tasks, Startup-folder entries, or dropped copies under `%APPDATA%`, then harvested credentials and surveillance data from browsers, Outlook and other email clients, FTP and VPN software, cookies, clipboard contents, keystrokes, screenshots, and in some cases cryptocurrency wallet addresses. Stolen data was exfiltrated over **SMTP, FTP, HTTP, and sometimes Tor-backed channels**, with some samples checking `agenttesla[.]com` for updates or using attacker mailboxes embedded in configuration data. Researchers also observed variants paired with additional malware, including a clipboard hijacker and **Crysis/Dharma ransomware**, underscoring how this long-running malware-as-a-service family combines commodity phishing delivery with evolving obfuscation and post-infection tradecraft.
Aug 15, 2026
Agent Tesla operators have continued to deliver the long-running information stealer through spearphishing lures and malicious Office documents that exploit Microsoft Equation Editor flaws **`CVE-2018-0802`** and **`CVE-2017-11882`**. In one intrusion, attackers posed as a trusted third party in an RFQ-themed email, used a macro-less DDE technique to fetch a second-stage document, and then launched a layered infection chain that concealed payloads inside a PNG image with double steganography before executing the malware from memory. Separate analysis of an RTF-based sample showed similar tradecraft, with shellcode dropping an executable into `%APPDATA%`, downloading a staged payload, and using reflective .NET loading to continue the compromise. The campaigns combined older exploit paths with increasingly sophisticated evasion and execution methods. Researchers observed lightly obfuscated loaders, delayed execution through repeated PowerShell connectivity checks, in-memory .NET assemblies, embedded resources for payload staging, and final execution through **Frenchy shellcode**, process hollowing, and delegation-based injection into `RegAsm`. Cisco Talos' long-term tracking of Agent Tesla activity and newer incident-response reporting both indicate that the malware family, active for years as a credential and data stealer, remains under active development and is being delivered through adaptable, multi-stage chains designed to bypass defenses and frustrate analysis.
Aug 15, 2026