Loading story…
Researchers documented a malware campaign that used a malicious Microsoft Compiled HTML Help (.chm) file packaged inside a 7zip archive to deliver Agent Tesla. When opened, the CHM launched embedded, obfuscated JavaScript that invoked PowerShell to verify internet connectivity and retrieve a second-stage payload disguised as a JPEG from pk-consult[.]hr, showing how CHM files can serve as a less-scrutinized initial access vector.
The downloaded stage unpacked a loader DLL and a gzip-compressed Agent Tesla payload directly in memory, then injected or loaded the malware into RegAsm.exe for execution. The final payload used FTP for data exfiltration and communicated with ftp.videoalliance[.]ru, underscoring a multi-stage infection chain designed to evade detection while stealing victim data.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A SANS ISC analysis documented a phishing campaign using a ZIP-delivered fake invoice CHM file that abused embedded JavaScript and the HTML Help shortcut object to auto-launch hidden PowerShell. The staged payloads were downloaded from hera[.]lt/Delta2.jpg and ultimately loaded Agent Tesla into InstallUtil.exe.
Unit 42 documented an attack chain in which a 7zip archive containing a malicious Microsoft Compiled HTML Help (.chm) file launched obfuscated JavaScript and PowerShell to download additional stages and execute Agent Tesla. The malware ultimately loaded into RegAsm.exe and used FTP exfiltration to connect to ftp.videoalliance[.]ru.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
splunk.com
Open sourceunit42.paloaltonetworks.com
Open sourceisc.sans.edu
Open sourcebazaar.abuse.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a phishing-led **Agent Tesla** infection chain that starts with a payment-receipt-themed email attachment and escalates through multiple scripted stages to full compromise. The campaign avoids older Office exploit techniques such as `CVE-2017-11882`, `CVE-2017-0199`, and `CVE-2018-0802`, instead relying on heavily obfuscated Batch and PowerShell loaders to launch payloads in memory, execute hidden scripts, and establish persistence while reducing visibility to traditional defenses. The final VB.NET payload uses anti-debugging, anti-sandbox, and anti-VM checks before performing **process hollowing** into legitimate Windows binaries such as `charmap.exe`. Once active, Agent Tesla steals browser credentials, cookies, autofill data, keystrokes, and screenshots, then exfiltrates the data over channels including SMTP, FTP, and Telegram bots, highlighting the threat posed by fileless execution and in-memory process injection in commodity malware campaigns.
Jun 29, 2026
Researchers analyzed multiple **AgentTesla** infection chains that begin with heavily obfuscated **JScript** files executed by `wscript.exe`, often delivered as phishing attachments and, in one case, an RFQ-themed spear-phishing lure named **"RFQ No 600002389875 RG724.JS"**. The scripts used layered evasion including centralized string arrays, index arithmetic, control-flow flattening, junk code, string reversal, delimiter noise, and a regex-based anti-debugging technique. In the Firebase-backed variant, the dropper retrieved a second-stage PowerShell payload from a **Google Firebase Storage** bucket, saved it to `C:\Temp\` under a randomized filename, and launched it with execution-policy bypass and hidden-window options, allowing malicious traffic to blend with trusted Google infrastructure. A related loader variant dropped PE payloads disguised as `.png` files into `C:\Users\Public\`, executed PowerShell in memory through a base64-decoded `IEX` command, and established persistence via the **`HKCU\Run`** registry key. The activity was linked to commodity cybercrime and the **AgentTesla** credential-theft family, which is commonly associated with credential harvesting, keylogging, screenshot capture, and data exfiltration over **SMTP**, **FTP/FTPS**, or **HTTP/HTTPS**. Detection remained relatively low across samples, with reports citing **14/76** and **20/76** antivirus detections at initial analysis, underscoring the effectiveness of the campaign’s obfuscation and abuse of legitimate cloud services.
Jun 29, 2026
**Agent Tesla** continued to appear in phishing-led intrusion chains that used malicious Office documents, ISO attachments, JavaScript, VBScript, and NSIS-based loaders to infect Windows systems and deploy the .NET infostealer in memory. Multiple reports described delivery through macro-enabled purchase-order lures, DHL-themed malspam, and droppers that abused `certutil.exe`, `mshta`, and spoofed or cybersquatted infrastructure such as `diodetechs[.]com`. Researchers also documented layered packing and concealment methods including oversized padded executables, embedded bitmap and PNG resources, reversed payloads, XOR and compression routines, and steganography that hid intermediate DLLs or final payloads inside image files before injection into processes such as `MSBuild.exe`. Once installed, Agent Tesla established persistence through **Run registry keys**, scheduled tasks, Startup-folder entries, or dropped copies under `%APPDATA%`, then harvested credentials and surveillance data from browsers, Outlook and other email clients, FTP and VPN software, cookies, clipboard contents, keystrokes, screenshots, and in some cases cryptocurrency wallet addresses. Stolen data was exfiltrated over **SMTP, FTP, HTTP, and sometimes Tor-backed channels**, with some samples checking `agenttesla[.]com` for updates or using attacker mailboxes embedded in configuration data. Researchers also observed variants paired with additional malware, including a clipboard hijacker and **Crysis/Dharma ransomware**, underscoring how this long-running malware-as-a-service family combines commodity phishing delivery with evolving obfuscation and post-infection tradecraft.
Aug 15, 2026