Agent Tesla

The user had opened an email 15 minutes before the alert. Subject line: “Outstanding Invoice — Action Required” The attachment? A well-crafted PDF.

15/06/2026 AgentTesla - spread through five campaigns themed around: ‘Documents’, ‘Invoices’, 'Orders' (two) and ‘Requests’. ... FormBook - spread through two campaigns themed around ‘Payments’ and ‘Requests’.

The user clicked. The PDF had a malicious link. It launched Edge with a custom URL that invoked the payload.

This was classic LOLBAS (Living-Off-the-Land Binaries and Scripts) abuse... msedge.exe └── powershell.exe └── curl.exe └── downloaded.dll └── rundll32.exe

T1059.001 — PowerShell Execution Malicious script executed via encoded PowerShell commands.

When the attached archive is extracted and opened, the heavily obfuscated Batch script springs into action.

Upon execution, these files kick off a multi-stage chain of extracting, deobfuscating, loading and executing secondary payloads (dynamic-link libraries), eventually detonating the final payload (executable).

When the attached archive is extracted and opened, the heavily obfuscated Batch script springs into action.

The top-ranking samples this week are Script files accounting for 65,22%. MSIL files follow in second place with 20,65%. As for third place, we find Office documents (Word, Excel, PowerPoint) with 14,13%.

Process injection is a critical phase of this operation. By forcing a trusted application like charmap.exe to run the malicious code...

This technique, known as process hollowing, involves creating a new instance of the legitimate process in a suspended state, unmapping its original code, and injecting the malicious payload before resuming the process thread.

They now employ heavily obfuscated scripts... When the attached archive is extracted and opened, the heavily obfuscated Batch script springs into action.

This article highlights a new obfuscation technique threat actors are using to hide malware through steganography within bitmap resources embedded in otherwise benign 32-bit .NET applications.

Process injection is a critical phase of this operation. By forcing a trusted application like charmap.exe to run the malicious code...

This technique, known as process hollowing, involves creating a new instance of the legitimate process in a suspended state, unmapping its original code, and injecting the malicious payload before resuming the process thread.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

This was classic LOLBAS (Living-Off-the-Land Binaries and Scripts) abuse... msedge.exe └── powershell.exe └── curl.exe └── downloaded.dll └── rundll32.exe

T1218.011 — Rundll32 Execution Abused rundll32.exe to stealthily execute the malicious DLL.

Furthermore, the payload actively performs anti-sandbox DLL checks and enumerates system hardware to identify virtual machines (Anti-VM). If the code detects artifacts commonly associated with automated malware analysis systems... it abruptly halts execution.

...enumerates system hardware to identify virtual machines (Anti-VM).

Agent Tesla has created hidden folders. AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings. APT28 has saved files with hidden file attributes. FIN13 has created hidden files and folders within a compromised Linux system /tmp directory and also used attrib.exe to hide gathered local host information.

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden. APT28 has used the WindowStyle parameter to conceal PowerShell windows.

By operating directly in memory, the malware avoids leaving recognizable artifacts on the hard drive... PowerShell, which then pulls and executes additional malicious code directly in memory.

Analysts discovered specific anti-debugging functions intended to detect whether the malware is being executed within a controlled debugging environment.

Additionally, it features a persistent keylogger that records every keystroke, ensuring that even newly typed passwords are captured.

It aggressively targets sensitive information, sweeping the compromised system to steal browser credentials, session cookies, and saved auto-fill data.

It aggressively targets sensitive information, sweeping the compromised system to steal browser credentials...

Beyond that, it steals stored credentials and cookies from Chrome and Firefox

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

Furthermore, the payload actively performs anti-sandbox DLL checks and enumerates system hardware to identify virtual machines (Anti-VM). If the code detects artifacts commonly associated with automated malware analysis systems... it abruptly halts execution.

...enumerates system hardware to identify virtual machines (Anti-VM).

Analysts discovered specific anti-debugging functions intended to detect whether the malware is being executed within a controlled debugging environment.

Additionally, it features a persistent keylogger that records every keystroke, ensuring that even newly typed passwords are captured.

The malware frequently captures screenshots of the active desktop, providing the attackers with real-time visual context of the victim’s activities.

Agent Tesla can steal data from the victim’s clipboard. APT38 used a Trojan called KEYLIME to collect data from the clipboard. APT39 has used tools capable of stealing contents of the clipboard.

Agent Tesla can access the victim’s webcam and record video. AsyncRAT can record screen content on targeted systems. Bandook has modules that are capable of capturing video from a victim's webcam. ... ZxShell has a command to perform video device spying.

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

First, we see a call to a location in the stack ... that will execute the function InternetOpenUrlA, we also see the C2 it will use... the second shellcode downloads further malware.

T1041 — Exfiltration Over C2 Channel Data was exfiltrated to an external C2 over HTTPS.

AgentTesla can transmit data via FTP, Telegram, SMTP, and other methods; this particular sample used SMTP.