Agent Tesla Campaigns Use Equation Editor Exploits and Multi-Stage .NET Loaders

Agent Tesla operators have continued to deliver the long-running information stealer through spearphishing lures and malicious Office documents that exploit Microsoft Equation Editor flaws CVE-2018-0802 and CVE-2017-11882. In one intrusion, attackers posed as a trusted third party in an RFQ-themed email, used a macro-less DDE technique to fetch a second-stage document, and then launched a layered infection chain that concealed payloads inside a PNG image with double steganography before executing the malware from memory. Separate analysis of an RTF-based sample showed similar tradecraft, with shellcode dropping an executable into %APPDATA%, downloading a staged payload, and using reflective .NET loading to continue the compromise.

The campaigns combined older exploit paths with increasingly sophisticated evasion and execution methods. Researchers observed lightly obfuscated loaders, delayed execution through repeated PowerShell connectivity checks, in-memory .NET assemblies, embedded resources for payload staging, and final execution through Frenchy shellcode, process hollowing, and delegation-based injection into RegAsm. Cisco Talos' long-term tracking of Agent Tesla activity and newer incident-response reporting both indicate that the malware family, active for years as a credential and data stealer, remains under active development and is being delivered through adaptable, multi-stage chains designed to bypass defenses and frustrate analysis.