Agent Tesla v4 Uses BEC Lures and In-Memory Injection to Evade Detection

A new Agent Tesla v4 campaign is targeting finance departments with a business email compromise-style lure that impersonates Metropolitan Bank and Trust Company and presents a forwarded, internal-looking email thread with a malicious attachment. Researchers said the attack chain is designed to look routine to recipients while delivering an infostealer that focuses on credential theft and account compromise.

After execution, the malware uses a JScript dropper with novel Unicode emoji-based obfuscation and deploys DonutLoader shellcode for reflective PE injection, allowing the final payload to run in memory without touching disk. Additional evasion features include ConfuserEx obfuscation, misleading metadata, and debugger detection, while the malware steals credentials from more than 40 applications, captures keystrokes and clipboard data, fingerprints infected hosts, and quickly exfiltrates data to an attacker-controlled FTP server; defenders were advised to hunt for emoji Unicode patterns alongside JScript indicators such as WScript.Shell and CreateObject.