Loading story…
Palo Alto Networks Unit 42 reported that OriginLogger emerged as a commoditized successor to Agent Tesla after that malware operation shut down in 2019, carrying forward much of the same code and behavior while introducing distinct builder artifacts, infrastructure, and configuration patterns. The malware functions as an information stealer and keylogger, with exfiltration observed over SMTP, FTP, web panels, and Telegram bots, giving operators multiple channels to collect stolen data from infected systems.
The research tied OriginLogger activity to infrastructure including originpro[.]me and originlogger[.]com, and documented a real-world dropper chain used to deliver the malware. By extracting 1,917 configurations, investigators identified recurring web panels, authentication infrastructure, obfuscated configuration storage methods, and Telegram bot naming conventions that helped cluster samples and distinguish OriginLogger from its Agent Tesla predecessor.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
Bitsight reported that between October and December 2023, at least 5,300 computers were compromised across about 210 observed AgentTesla/OriginLogger campaigns. The telemetry indicated the United States was the most targeted country, followed by China and Germany.
A newer OriginLogger builder was compiled on June 29, 2022 and authenticated over TCP port 3345 to 23.106.223[.]46.
A VirusTotal search for the builder’s default SmartWords string matched a file with SHA256 595a7ea981a3948c4f387a5a6af54a70a41dd604685c72cbd2a55880c2b702ed uploaded on May 17, 2022.
Beginning around March 7, 2022, the domain 0xfd3[.]com resolved to 23.106.223[.]47. The same domain also had DNS MX and TXT records for mail.originlogger[.]com.
Since March 3, 2022, IP address 23.106.223[.]46 has resolved to originpro[.]me, tying that host to OriginLogger authentication infrastructure.
An older OriginLogger builder analyzed by the researcher was compiled on September 6, 2020 and attempted to authenticate with 74.118.138[.]76.
On March 4, 2019, Agent Tesla shut down due to legal troubles. Its developers then suggested in a Discord announcement that users switch to OriginLogger.
A 2018 YouTube video promoted OriginLogger as a “fully undetectable” malware product and showed its web panel and builder, indicating the malware was being marketed publicly by that year.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 29 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
bitsight.com
Open sourceunit42.paloaltonetworks.com
Open sourcenews.sophos.com
Open sourcekrebsonsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Agent Tesla** continued to appear in phishing-led intrusion chains that used malicious Office documents, ISO attachments, JavaScript, VBScript, and NSIS-based loaders to infect Windows systems and deploy the .NET infostealer in memory. Multiple reports described delivery through macro-enabled purchase-order lures, DHL-themed malspam, and droppers that abused `certutil.exe`, `mshta`, and spoofed or cybersquatted infrastructure such as `diodetechs[.]com`. Researchers also documented layered packing and concealment methods including oversized padded executables, embedded bitmap and PNG resources, reversed payloads, XOR and compression routines, and steganography that hid intermediate DLLs or final payloads inside image files before injection into processes such as `MSBuild.exe`. Once installed, Agent Tesla established persistence through **Run registry keys**, scheduled tasks, Startup-folder entries, or dropped copies under `%APPDATA%`, then harvested credentials and surveillance data from browsers, Outlook and other email clients, FTP and VPN software, cookies, clipboard contents, keystrokes, screenshots, and in some cases cryptocurrency wallet addresses. Stolen data was exfiltrated over **SMTP, FTP, HTTP, and sometimes Tor-backed channels**, with some samples checking `agenttesla[.]com` for updates or using attacker mailboxes embedded in configuration data. Researchers also observed variants paired with additional malware, including a clipboard hijacker and **Crysis/Dharma ransomware**, underscoring how this long-running malware-as-a-service family combines commodity phishing delivery with evolving obfuscation and post-infection tradecraft.
Aug 15, 2026
Researchers reported that **MassLogger**, a .NET credential-stealing malware sold on criminal forums, has evolved from heavily obfuscated loader-based campaigns into a more stealthy **fileless** variant that stores staged payloads in the **Windows Registry** and executes them in memory. Seqrite said recent infections begin with a `.VBE` loader, progress through multiple .NET stagers, and ultimately inject the final payload into `AddInProcess32.exe` via **process hollowing** while maintaining persistence through a scheduled task. The malware can also check for installed security products and stop execution when multiple antivirus tools are present, adding another layer of defense evasion. Analysis across multiple reports shows MassLogger consistently focuses on credential theft while using increasingly sophisticated anti-analysis techniques. Avast previously documented version 3 using encrypted configuration blobs, **PBKDF2**-derived keys, **AES** decryption, SHA-256 integrity checks, encrypted strings, and a large custom interpreter to conceal control flow, while newer samples avoid writing stolen data to disk. Related loader research found the **ReZer0** .NET loader supports anti-VM and anti-sandbox checks, scheduled-task persistence, in-memory assembly loading, download-and-run behavior, and process hollowing. Seqrite added that the latest fileless variant can steal browser and email credentials, log keystrokes, capture clipboard data, collect host information, and exfiltrate data through **FTP**, **SMTP**, or **Telegram**, with one France-targeted branch attempting to fetch an additional payload from `hxxps://144.91.92.251/MoDi.txt`.
Aug 15, 2026
Researchers analyzed multiple **AgentTesla** infection chains that begin with heavily obfuscated **JScript** files executed by `wscript.exe`, often delivered as phishing attachments and, in one case, an RFQ-themed spear-phishing lure named **"RFQ No 600002389875 RG724.JS"**. The scripts used layered evasion including centralized string arrays, index arithmetic, control-flow flattening, junk code, string reversal, delimiter noise, and a regex-based anti-debugging technique. In the Firebase-backed variant, the dropper retrieved a second-stage PowerShell payload from a **Google Firebase Storage** bucket, saved it to `C:\Temp\` under a randomized filename, and launched it with execution-policy bypass and hidden-window options, allowing malicious traffic to blend with trusted Google infrastructure. A related loader variant dropped PE payloads disguised as `.png` files into `C:\Users\Public\`, executed PowerShell in memory through a base64-decoded `IEX` command, and established persistence via the **`HKCU\Run`** registry key. The activity was linked to commodity cybercrime and the **AgentTesla** credential-theft family, which is commonly associated with credential harvesting, keylogging, screenshot capture, and data exfiltration over **SMTP**, **FTP/FTPS**, or **HTTP/HTTPS**. Detection remained relatively low across samples, with reports citing **14/76** and **20/76** antivirus detections at initial analysis, underscoring the effectiveness of the campaign’s obfuscation and abuse of legitimate cloud services.
Jun 29, 2026