Loading story…
A new Agent Tesla v4 campaign is targeting finance departments with a business email compromise-style lure that impersonates Metropolitan Bank and Trust Company and presents a forwarded, internal-looking email thread with a malicious attachment. Researchers said the attack chain is designed to look routine to recipients while delivering an infostealer that focuses on credential theft and account compromise.
After execution, the malware uses a JScript dropper with novel Unicode emoji-based obfuscation and deploys DonutLoader shellcode for reflective PE injection, allowing the final payload to run in memory without touching disk. Additional evasion features include ConfuserEx obfuscation, misleading metadata, and debugger detection, while the malware steals credentials from more than 40 applications, captures keystrokes and clipboard data, fingerprints infected hosts, and quickly exfiltrates data to an attacker-controlled FTP server; defenders were advised to hunt for emoji Unicode patterns alongside JScript indicators such as WScript.Shell and CreateObject.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
On August 20, KnowBe4 published a blog post detailing the campaign's evasion methods, including ConfuserEx obfuscation, anti-debugging, hardware fingerprinting, and rapid FTP exfiltration. The post also said defenders could detect the dropper with YARA rules matching the Unicode emoji pattern alongside JScript indicators such as WScript.Shell or CreateObject.
KnowBe4 reported a new Agent Tesla v4 campaign that used a business email compromise lure impersonating Metropolitan Bank and Trust Company to target finance departments. The campaign delivered Agent Tesla through a JScript dropper using emoji-based Unicode obfuscation and in-memory execution via DonutLoader reflective PE injection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourceinfosecurity-magazine.com
Open sourceblog.knowbe4.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Agent Tesla** continued to appear in phishing-led intrusion chains that used malicious Office documents, ISO attachments, JavaScript, VBScript, and NSIS-based loaders to infect Windows systems and deploy the .NET infostealer in memory. Multiple reports described delivery through macro-enabled purchase-order lures, DHL-themed malspam, and droppers that abused `certutil.exe`, `mshta`, and spoofed or cybersquatted infrastructure such as `diodetechs[.]com`. Researchers also documented layered packing and concealment methods including oversized padded executables, embedded bitmap and PNG resources, reversed payloads, XOR and compression routines, and steganography that hid intermediate DLLs or final payloads inside image files before injection into processes such as `MSBuild.exe`. Once installed, Agent Tesla established persistence through **Run registry keys**, scheduled tasks, Startup-folder entries, or dropped copies under `%APPDATA%`, then harvested credentials and surveillance data from browsers, Outlook and other email clients, FTP and VPN software, cookies, clipboard contents, keystrokes, screenshots, and in some cases cryptocurrency wallet addresses. Stolen data was exfiltrated over **SMTP, FTP, HTTP, and sometimes Tor-backed channels**, with some samples checking `agenttesla[.]com` for updates or using attacker mailboxes embedded in configuration data. Researchers also observed variants paired with additional malware, including a clipboard hijacker and **Crysis/Dharma ransomware**, underscoring how this long-running malware-as-a-service family combines commodity phishing delivery with evolving obfuscation and post-infection tradecraft.
Aug 15, 2026
Agent Tesla operators have continued to deliver the long-running information stealer through spearphishing lures and malicious Office documents that exploit Microsoft Equation Editor flaws **`CVE-2018-0802`** and **`CVE-2017-11882`**. In one intrusion, attackers posed as a trusted third party in an RFQ-themed email, used a macro-less DDE technique to fetch a second-stage document, and then launched a layered infection chain that concealed payloads inside a PNG image with double steganography before executing the malware from memory. Separate analysis of an RTF-based sample showed similar tradecraft, with shellcode dropping an executable into `%APPDATA%`, downloading a staged payload, and using reflective .NET loading to continue the compromise. The campaigns combined older exploit paths with increasingly sophisticated evasion and execution methods. Researchers observed lightly obfuscated loaders, delayed execution through repeated PowerShell connectivity checks, in-memory .NET assemblies, embedded resources for payload staging, and final execution through **Frenchy shellcode**, process hollowing, and delegation-based injection into `RegAsm`. Cisco Talos' long-term tracking of Agent Tesla activity and newer incident-response reporting both indicate that the malware family, active for years as a credential and data stealer, remains under active development and is being delivered through adaptable, multi-stage chains designed to bypass defenses and frustrate analysis.
Aug 15, 2026
A phishing campaign is distributing **Agent Tesla** through Spanish-language business emails that impersonate purchase orders and invoices, targeting organizations across Latin America and Spain. Broadcom reported that the attack delivers a RAR attachment disguised as a PDF, then executes a multi-stage chain involving a JScript loader, PowerShell downloaders, an in-memory .NET loader, and a final **Agent Tesla** payload that runs largely in memory. The campaign uses obfuscation, masquerading, urgency-themed messaging, and an **AMSI bypass** to evade detection while minimizing disk artifacts. The malware is designed to steal credentials, system information, and other sensitive data, then exfiltrate it over encrypted HTTP(S) channels. The activity aligns with earlier large-scale Agent Tesla spam operations that used polished corporate-themed lures and impersonated legitimate companies to infect business users at scale, with especially high impact in Mexico and Spain. Across observed campaigns, Agent Tesla variants have targeted credentials stored in browsers, email clients, FTP and VPN tools, remote access software, and messaging applications, while also supporting screenshot capture, keylogging, and clipboard theft.
Aug 15, 2026