Loading story…
Agent Tesla operators have continued to deliver the long-running information stealer through spearphishing lures and malicious Office documents that exploit Microsoft Equation Editor flaws CVE-2018-0802 and CVE-2017-11882. In one intrusion, attackers posed as a trusted third party in an RFQ-themed email, used a macro-less DDE technique to fetch a second-stage document, and then launched a layered infection chain that concealed payloads inside a PNG image with double steganography before executing the malware from memory. Separate analysis of an RTF-based sample showed similar tradecraft, with shellcode dropping an executable into %APPDATA%, downloading a staged payload, and using reflective .NET loading to continue the compromise.
The campaigns combined older exploit paths with increasingly sophisticated evasion and execution methods. Researchers observed lightly obfuscated loaders, delayed execution through repeated PowerShell connectivity checks, in-memory .NET assemblies, embedded resources for payload staging, and final execution through Frenchy shellcode, process hollowing, and delegation-based injection into RegAsm. Cisco Talos' long-term tracking of Agent Tesla activity and newer incident-response reporting both indicate that the malware family, active for years as a credential and data stealer, remains under active development and is being delivered through adaptable, multi-stage chains designed to bypass defenses and frustrate analysis.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
Tony Lambert published an analysis of a malicious RTF document that exploited Equation Editor and staged multiple .NET payloads culminating in AgentTesla. The chain downloaded try.exe, fetched a fake PNG from 185.222.58[.]56, reversed it into a .NET DLL, and invoked an obfuscated method from memory.
Morphisec Labs reported that it had tracked many Agent Tesla variants using Frenchy shellcode since January 2020. This marks the observed use of that shellcode framework in Agent Tesla delivery chains.
Cisco Talos published "SWEED: Exposing years of Agent Tesla campaigns," documenting Agent Tesla activity across multiple campaigns. The reference establishes public reporting on the malware family by mid-2019.
Agent Tesla, an information-stealing malware family, has been active since 2014. The Morphisec analysis notes its long-running use and later evolution into many modified variants.
The Morphisec-analyzed chain used Frenchy shellcode, delegation-based execution, and process hollowing to inject the final payload into RegAsm. The payload executed from memory as the Agent Tesla Dark Stealer module.
Morphisec's investigation found a lightly DeepSea-obfuscated loader that concealed the next stage inside a PNG image with two layers of steganography. A decrypted in-memory .NET loader then established persistence, removed zone identifiers, and prepared the next payload.
In the same late-October intrusion, the second-stage document exploited Microsoft Equation Editor vulnerabilities CVE-2018-0802 and CVE-2017-11882. After exploitation, it replaced the visible document content and downloaded a first-stage loader from the same C2.
At the end of October, attackers repeatedly targeted a Morphisec customer with spearphishing emails posing as RFQs from a trusted third party. The campaign used a macro-less DDE lure document to fetch a second-stage file from a C2 server.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
blog.morphisec.com
Open sourceforensicitguy.github.io
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Agent Tesla** continued to appear in phishing-led intrusion chains that used malicious Office documents, ISO attachments, JavaScript, VBScript, and NSIS-based loaders to infect Windows systems and deploy the .NET infostealer in memory. Multiple reports described delivery through macro-enabled purchase-order lures, DHL-themed malspam, and droppers that abused `certutil.exe`, `mshta`, and spoofed or cybersquatted infrastructure such as `diodetechs[.]com`. Researchers also documented layered packing and concealment methods including oversized padded executables, embedded bitmap and PNG resources, reversed payloads, XOR and compression routines, and steganography that hid intermediate DLLs or final payloads inside image files before injection into processes such as `MSBuild.exe`. Once installed, Agent Tesla established persistence through **Run registry keys**, scheduled tasks, Startup-folder entries, or dropped copies under `%APPDATA%`, then harvested credentials and surveillance data from browsers, Outlook and other email clients, FTP and VPN software, cookies, clipboard contents, keystrokes, screenshots, and in some cases cryptocurrency wallet addresses. Stolen data was exfiltrated over **SMTP, FTP, HTTP, and sometimes Tor-backed channels**, with some samples checking `agenttesla[.]com` for updates or using attacker mailboxes embedded in configuration data. Researchers also observed variants paired with additional malware, including a clipboard hijacker and **Crysis/Dharma ransomware**, underscoring how this long-running malware-as-a-service family combines commodity phishing delivery with evolving obfuscation and post-infection tradecraft.
Aug 15, 2026
Researchers detailed a phishing-led **Agent Tesla** infection chain that starts with a payment-receipt-themed email attachment and escalates through multiple scripted stages to full compromise. The campaign avoids older Office exploit techniques such as `CVE-2017-11882`, `CVE-2017-0199`, and `CVE-2018-0802`, instead relying on heavily obfuscated Batch and PowerShell loaders to launch payloads in memory, execute hidden scripts, and establish persistence while reducing visibility to traditional defenses. The final VB.NET payload uses anti-debugging, anti-sandbox, and anti-VM checks before performing **process hollowing** into legitimate Windows binaries such as `charmap.exe`. Once active, Agent Tesla steals browser credentials, cookies, autofill data, keystrokes, and screenshots, then exfiltrates the data over channels including SMTP, FTP, and Telegram bots, highlighting the threat posed by fileless execution and in-memory process injection in commodity malware campaigns.
Jun 29, 2026
Researchers analyzed multiple **AgentTesla** infection chains that begin with heavily obfuscated **JScript** files executed by `wscript.exe`, often delivered as phishing attachments and, in one case, an RFQ-themed spear-phishing lure named **"RFQ No 600002389875 RG724.JS"**. The scripts used layered evasion including centralized string arrays, index arithmetic, control-flow flattening, junk code, string reversal, delimiter noise, and a regex-based anti-debugging technique. In the Firebase-backed variant, the dropper retrieved a second-stage PowerShell payload from a **Google Firebase Storage** bucket, saved it to `C:\Temp\` under a randomized filename, and launched it with execution-policy bypass and hidden-window options, allowing malicious traffic to blend with trusted Google infrastructure. A related loader variant dropped PE payloads disguised as `.png` files into `C:\Users\Public\`, executed PowerShell in memory through a base64-decoded `IEX` command, and established persistence via the **`HKCU\Run`** registry key. The activity was linked to commodity cybercrime and the **AgentTesla** credential-theft family, which is commonly associated with credential harvesting, keylogging, screenshot capture, and data exfiltration over **SMTP**, **FTP/FTPS**, or **HTTP/HTTPS**. Detection remained relatively low across samples, with reports citing **14/76** and **20/76** antivirus detections at initial analysis, underscoring the effectiveness of the campaign’s obfuscation and abuse of legitimate cloud services.
Jun 29, 2026