Agent Tesla Phishing Campaign Uses In-Memory Loaders to Target LATAM Organizations

A phishing campaign is distributing Agent Tesla through Spanish-language business emails that impersonate purchase orders and invoices, targeting organizations across Latin America and Spain. Broadcom reported that the attack delivers a RAR attachment disguised as a PDF, then executes a multi-stage chain involving a JScript loader, PowerShell downloaders, an in-memory .NET loader, and a final Agent Tesla payload that runs largely in memory. The campaign uses obfuscation, masquerading, urgency-themed messaging, and an AMSI bypass to evade detection while minimizing disk artifacts.

The malware is designed to steal credentials, system information, and other sensitive data, then exfiltrate it over encrypted HTTP(S) channels. The activity aligns with earlier large-scale Agent Tesla spam operations that used polished corporate-themed lures and impersonated legitimate companies to infect business users at scale, with especially high impact in Mexico and Spain. Across observed campaigns, Agent Tesla variants have targeted credentials stored in browsers, email clients, FTP and VPN tools, remote access software, and messaging applications, while also supporting screenshot capture, keylogging, and clipboard theft.