Loading story…
Multiple security firms reported phishing campaigns that weaponized Microsoft PowerPoint Add-in files (.ppam) to deliver Agent Tesla and, in some variants, other malware such as Lokibot, AZORult, NanoCore RAT, and a cryptocurrency clipboard stealer. The lures commonly masqueraded as business documents such as wire transfer receipts or templates, then abused PowerPoint add-in behavior to trigger VBA execution when the file was closed. The macro chains launched living-off-the-land tools including mshta.exe, PowerShell, and Outlook COM automation, while shortened links and services such as Pastebin, Bitly, Blogspot, MediaFire, and GitHub hosted staged payloads and command infrastructure. Researchers linked several of the campaigns to Aggah, which targeted organizations across multiple countries and sectors and used spoofed business email domains to improve delivery.
Get the infrastructure and lures behind it.
12 events from the most recent confirmed update back to the earliest known activity.
FortiGuard Labs analyzed a phishing campaign that used a fake purchase order and a malicious PPAM attachment named "order001.ppam" to target a Ukrainian manufacturing organization involved in raw materials and chemicals. The multistage chain used Bitly and MediaFire-hosted payloads, registry and scheduled-task persistence, and injected Agent Tesla into aspnet_compiler.exe.
Netskope Threat Labs observed an increase since December 2021 in phishing campaigns using malicious PowerPoint add-in files. The campaigns delivered AgentTesla and a PowerShell-based cryptocurrency clipboard stealer via cloud-hosted payload stages.
HP observed the intermediary wallet transfer the balance to Bitcoin address 1NDyJtNTjmwk5xPNhjgAMu4HDHigtobu1s. The destination address was associated with Binance.
The balance from the attacker Bitcoin wallet was transferred to intermediary wallet 1PGRpP14sSBER6x2choH31wkML1hXqykNj. This movement was part of HP's tracing of proceeds from the campaign's cryptocurrency theft.
HP reported that 0.00311321 Bitcoin was transferred into the attacker wallet used by the campaign, possibly from a victim. The wallet was tied to the campaign's clipboard-stealing component.
HP Wolf Security reported that in May 2020 an Aggah-linked malspam campaign used renamed PowerPoint add-ins to deliver Agent Tesla and a PowerShell Bitcoin clipboard stealer. Telemetry showed targeting across six sectors and eight countries, predominantly in Europe.
ThreatLabz observed malicious Microsoft PowerPoint files in the wild in March 2020 delivering AZORult and NanoCore RAT through a multistage loader chain. The activity targeted users in South Korea and Indonesia and was correlated to the Aggah campaign.
The .NET loader later named FreeDom was first observed on VirusTotal. Researchers described it as a GZip-compressed .NET loader used to inject final malware into notepad.exe.
ThreatLabz later referenced Unit 42 documentation from April 2019 that associated the Aggah campaign with large-scale activity using services such as Bitly, BlogSpot, and Pastebin for command-and-control and payload delivery.
SANS analyzed a malspam campaign delivering Agent Tesla through a macro-enabled PowerPoint add-in file named SKM-03753WIRE23560USD.ppam masquerading as a wire transfer receipt. The multistage chain used PowerShell, mshta, MediaFire, Blogger, GitHub, NSudo, and a .NET injector to disable defenses and inject Agent Tesla into aspnet_compiler.exe.
Trustwave analyzed a malicious spam campaign using a PowerPoint add-in attachment named "REQUEST FOR OFFER 08-20-2020.ppt." The Auto_Close-triggered chain used a crafted j.mp URL, Pastebin-hosted stages, AMSI bypass, and memory injection to deliver Lokibot.
Xavier Mertens analyzed a phishing-delivered PowerPoint add-in disguised as "Payments detail.pot" that silently installed and executed an Auto_Close macro on exit. The chain used j.mp and Pastebin-hosted stages to establish persistence, bypass AMSI, and deliver AgentTesla.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 165 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
8 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourcefortinet.com
Open sourcenetskope.com
Open sourceisc.sans.edu
Open sourcetrustwave.com
Open sourcethreatresearch.ext.hp.com
Open sourceisc.sans.edu
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a phishing-led **Agent Tesla** infection chain that starts with a payment-receipt-themed email attachment and escalates through multiple scripted stages to full compromise. The campaign avoids older Office exploit techniques such as `CVE-2017-11882`, `CVE-2017-0199`, and `CVE-2018-0802`, instead relying on heavily obfuscated Batch and PowerShell loaders to launch payloads in memory, execute hidden scripts, and establish persistence while reducing visibility to traditional defenses. The final VB.NET payload uses anti-debugging, anti-sandbox, and anti-VM checks before performing **process hollowing** into legitimate Windows binaries such as `charmap.exe`. Once active, Agent Tesla steals browser credentials, cookies, autofill data, keystrokes, and screenshots, then exfiltrates the data over channels including SMTP, FTP, and Telegram bots, highlighting the threat posed by fileless execution and in-memory process injection in commodity malware campaigns.
Jun 29, 2026
**Agent Tesla** continued to appear in phishing-led intrusion chains that used malicious Office documents, ISO attachments, JavaScript, VBScript, and NSIS-based loaders to infect Windows systems and deploy the .NET infostealer in memory. Multiple reports described delivery through macro-enabled purchase-order lures, DHL-themed malspam, and droppers that abused `certutil.exe`, `mshta`, and spoofed or cybersquatted infrastructure such as `diodetechs[.]com`. Researchers also documented layered packing and concealment methods including oversized padded executables, embedded bitmap and PNG resources, reversed payloads, XOR and compression routines, and steganography that hid intermediate DLLs or final payloads inside image files before injection into processes such as `MSBuild.exe`. Once installed, Agent Tesla established persistence through **Run registry keys**, scheduled tasks, Startup-folder entries, or dropped copies under `%APPDATA%`, then harvested credentials and surveillance data from browsers, Outlook and other email clients, FTP and VPN software, cookies, clipboard contents, keystrokes, screenshots, and in some cases cryptocurrency wallet addresses. Stolen data was exfiltrated over **SMTP, FTP, HTTP, and sometimes Tor-backed channels**, with some samples checking `agenttesla[.]com` for updates or using attacker mailboxes embedded in configuration data. Researchers also observed variants paired with additional malware, including a clipboard hijacker and **Crysis/Dharma ransomware**, underscoring how this long-running malware-as-a-service family combines commodity phishing delivery with evolving obfuscation and post-infection tradecraft.
Aug 15, 2026
Researchers analyzed multiple **AgentTesla** infection chains that begin with heavily obfuscated **JScript** files executed by `wscript.exe`, often delivered as phishing attachments and, in one case, an RFQ-themed spear-phishing lure named **"RFQ No 600002389875 RG724.JS"**. The scripts used layered evasion including centralized string arrays, index arithmetic, control-flow flattening, junk code, string reversal, delimiter noise, and a regex-based anti-debugging technique. In the Firebase-backed variant, the dropper retrieved a second-stage PowerShell payload from a **Google Firebase Storage** bucket, saved it to `C:\Temp\` under a randomized filename, and launched it with execution-policy bypass and hidden-window options, allowing malicious traffic to blend with trusted Google infrastructure. A related loader variant dropped PE payloads disguised as `.png` files into `C:\Users\Public\`, executed PowerShell in memory through a base64-decoded `IEX` command, and established persistence via the **`HKCU\Run`** registry key. The activity was linked to commodity cybercrime and the **AgentTesla** credential-theft family, which is commonly associated with credential harvesting, keylogging, screenshot capture, and data exfiltration over **SMTP**, **FTP/FTPS**, or **HTTP/HTTPS**. Detection remained relatively low across samples, with reports citing **14/76** and **20/76** antivirus detections at initial analysis, underscoring the effectiveness of the campaign’s obfuscation and abuse of legitimate cloud services.
Jun 29, 2026