Agent Tesla v4 infostealer with emoji obfuscation and BEC delivery
Malware Activity
Summary
Hide ▲
Show ▼
The Agent Tesla v4 infostealer is now being delivered through a BEC lure that targets finance departments and can steal credentials from more than 40 applications. The sample adds Unicode emoji obfuscation, ConfuserEx, and DonutLoader injection to make detection harder. It also exfiltrates stolen data to attacker-controlled infrastructure within seconds, increasing the chance of rapid account compromise.
Timeline
-
20.08.2026 03:00 2 articles · 1d ago
Agent Tesla v4 is delivered through a spoofed Metropolitan Bank and Trust Company email
Initial DisclosureKnowBe4 identified Agent Tesla v4 being delivered through a sophisticated business email compromise lure targeting finance departments, with attackers spoofing Metropolitan Bank and Trust Company and presenting the message as forwarded internal correspondence. The Jscript dropper uses Unicode emoji obfuscation, ConfuserEx scrambling, and DonutLoader reflective PE injection to evade detection, while the malware harvests credentials from web browsers, messaging platforms, and native Windows credential repositories, creates a persistent hardware fingerprint, disables validation for outgoing connections, and sends the credential dump to an attacker-controlled FTP server within seconds. KnowBe4 also advised updating email security rules and using YARA rules that match the emoji distribution pattern plus JScript-specific calls to catch this family.
Show sources
- New Agent Tesla Malware Variant Boosts Evasion Capabilities — www.infosecurity-magazine.com — 21.08.2026 15:00
- New Agent Tesla Malware Variant Boosts Evasion Capabilities — www.infosecurity-magazine.com — 21.08.2026 15:00