Agent Tesla campaigns used phishing, steganography, and script loaders to steal credentials

Agent Tesla continued to appear in phishing-led intrusion chains that used malicious Office documents, ISO attachments, JavaScript, VBScript, and NSIS-based loaders to infect Windows systems and deploy the .NET infostealer in memory. Multiple reports described delivery through macro-enabled purchase-order lures, DHL-themed malspam, and droppers that abused certutil.exe, mshta, and spoofed or cybersquatted infrastructure such as diodetechs[.]com. Researchers also documented layered packing and concealment methods including oversized padded executables, embedded bitmap and PNG resources, reversed payloads, XOR and compression routines, and steganography that hid intermediate DLLs or final payloads inside image files before injection into processes such as MSBuild.exe.

Once installed, Agent Tesla established persistence through Run registry keys, scheduled tasks, Startup-folder entries, or dropped copies under %APPDATA%, then harvested credentials and surveillance data from browsers, Outlook and other email clients, FTP and VPN software, cookies, clipboard contents, keystrokes, screenshots, and in some cases cryptocurrency wallet addresses. Stolen data was exfiltrated over SMTP, FTP, HTTP, and sometimes Tor-backed channels, with some samples checking agenttesla[.]com for updates or using attacker mailboxes embedded in configuration data. Researchers also observed variants paired with additional malware, including a clipboard hijacker and Crysis/Dharma ransomware, underscoring how this long-running malware-as-a-service family combines commodity phishing delivery with evolving obfuscation and post-infection tradecraft.