Agent

Agent is an overloaded malware designation used across multiple vendor taxonomies for unrelated malicious programs, including Android banking trojans and spyware, downloaders, Windows loaders and ransomware-labeled samples, macOS remote-access components, and custom proxy tooling used in intrusion operations. As a result, the name does not identify a single coherent malware family without additional context.

In Android threat reporting, Agent commonly appears as a banking-trojan, spyware, downloader, or clicker classification. Variants associated with this naming have been used to download and launch additional malicious modules, support financial fraud, and in some cases facilitate theft of SMS-delivered verification codes or other sensitive data. In Windows reporting, Agent has also been used as a generic detection label for droppers and loaders delivered through malicious documents and DLL side-loading chains that establish persistence, execute secondary payloads in memory, and enable remote control or information theft. In macOS reporting, an Agent component has been described as a RAT-like binary installed for persistence and remote access in cryptocurrency-focused malware campaigns. Separately, in Operation Wocao, a custom tool named Agent functioned as a multi-hop proxy that upgraded sockets to TLS to relay operator traffic through compromised infrastructure.

Because these references span distinct malware classes, platforms, and campaigns, high-confidence enrichment should treat Agent as an ambiguous umbrella label rather than a uniquely attributable malware family. Any precise classification depends on the specific sample or campaign context.