A new version of the notorious Agent Telsa malware contains new features designed to evade detection and steal credentials, KnowBe4 research has identified.
The cybersecurity firm provided a detailed analysis of the Agent Tesla version 4 infostealer, which was observed being dropped via a sophisticated business email compromise (BEC) lure targeting finance departments.
The malware used a novel obfuscation technique involving Unicode emoji characters embedded throughout the code body.
The final payload is configured to sweep credentials from more than 40 applications and rapidly exfiltrate them via file transfer mechanism to a single threat actor-controlled domain.
The researchers have advised security teams to update their email security rules to catch Agent Tesla before it can harvest credentials.
The New Agent Tesla Campaign
The KnowBe4 researchers observed the attempted delivery of Agent Tesla v4 in an email, which arrived as forwarded thread presenting as internal correspondence forwarded to an account’s contact.
The attackers spoofed the address of a legitimate Philippines-based commercial bank called Metropolitan Bank and Trust Company. The email thread was designed to look like an in-progress discussion the recipient has been brought into late, who was directly instructed to confirm an attached document and reply.
The malware operates via Jscript dropper, which can be launched with a simple initial open-with dialog.
The script body contains a number of Unicode emoji characters, such as hearts and water droplets, which are interleaved directly through the code. These characters obfuscate the malicious file by disrupting string-based signature matching and making the code visually noisy enough to defeat casual review.
Once launched, the script writes two files to C:UsersPublicLibraries, one of which is a misdirection, resulting in the extension passing it into DonutLoader shellcode for reflective portable executable (PE) injection.
This means the final Agent Tesla binary never touches the filesystem and cannot be detected by file-based scanners.
Agent Tesla v4 contains a number of defense evasion capabilities. Among these, it is intentionally scrambled using an obfuscator tool called “ConfuserEx” to make it nearly unreadable for anyone trying to analyze it.
The malware’s assembly also presents itself as a Python installer in its embedded metadata. In addition, it uses a standard Windows function as its first line of defense to detect if it is being watched by a debugger and stops running if it finds one to avoid being analyzed.
Before harvesting credentials, the malware creates a persistent hardware fingerprint, allowing attackers to track victims consistently across IS reinstalls or IP rotations.
Agent Tesla deploys several other persistence mechanisms, including disabling validation for all outgoing connections, ensuring the malware maintains unhindered communication with C2 infrastructure without triggering security alerts or errors.
The malware is designed to sweep credentials from various sources, including web browsers, messaging platforms and native Windows credential repositories.
Agent Tesla is also capable of intercepting keystrokes using the keylogger and clipboard tool.
All exfiltrated files include a system fingerprint header: timestamp, username, computer name, OS name, CPU, RAM, public IP and the MD5 hardware ID.
KnowBe4 noted that the credential dump lands on the attacker’s FTP server within seconds of execution, with no delayed staging.
Mitigating the Emoji-Obfuscation Tactic
The KnowBe4 blog, published on August 20, noted that the emoji-obfuscation approach in the JS dropper does not survive any YARA rule that looks for the Unicode code points used alongside JScript-specific patterns.
“A rule matching both the emoji distribution pattern and WScript.Shell or CreateObject calls will catch this family,” the researchers said.
