Sophisticated Agent Tesla Campaign Uses Emoji-Obfuscated JScript to Evade Detection
A recent business email compromise (BEC) campaign is deploying Agent Tesla v4, an advanced infostealer, using a novel evasion technique: emoji-saturated JScript to conceal malicious code. The attack targets finance teams with fake bank payment lures, impersonating Metropolitan Bank and Trust Company, a legitimate Philippine bank.
Attack Chain & Evasion Tactics
The campaign begins with an email masquerading as internal correspondence about pending wire transfers, pressuring recipients to open an attachment named "SWIFT Payment Maker 103 – 10.06.26.JS" a 6.94 MB JScript file disguised as payment documentation.
When executed via Windows Script Host, the script employs Unicode emojis (hearts, droplets) to disrupt string-based detection and manual analysis while preserving executable logic. Unlike typical malware, it avoids Base64-encoded payloads or second-stage downloads.
Instead, the dropper writes two files to C:\Users\Public\Libraries\:
- A 32-bit .NET loader (
.exe) - A fake
.ttffont file containing an encoded Agent Tesla payload
The loader uses DonutLoader shellcode to reflectively inject the final payload into memory, bypassing disk-based detection.
Agent Tesla’s Stealth & Data Theft Capabilities
The ConfuserEx-obfuscated .NET 4.0 binary falsely identifies itself as "Python 3.11.3 (64-bit)" despite being a 32-bit x86 executable. Before execution, it performs anti-analysis checks, including:
- Debugger detection
- Cloud-hosting IP verification
- Timing-based VM detection
- Sandbox DLL discovery
- WMI queries for VMware/VirtualBox
If any check fails, the malware exits silently.
Once active, Agent Tesla deploys 21 harvesting modules targeting:
- 27 Chromium-based browsers (Chrome, Edge, etc.)
- 13 Mozilla-based browsers (Firefox, Thunderbird)
- Outlook, Foxmail, Discord, Windows Credential Manager
- Discord OAuth2 tokens (enabling account takeovers)
For Chromium browsers, it retrieves the encrypted master key from Local State, decrypts it via DPAPI, and extracts credentials using AES-GCM. It also copies locked SQLite databases for offline parsing.
Exfiltration & Tracking
Stolen data is sent via FTP to ftp[.]melrz[.]com (resolving to 162[.]0[.]209[.]89), with credentials hardcoded in plaintext:
- Username:
info@melrz[.]com - Password:
Newmoney2023..
The malware also generates a victim hardware ID using WMI-derived values (motherboard serial, processor ID, MAC address) for long-term tracking.
Indicators of Compromise (IoCs)
- JScript SHA-256:
615f9ecc51ccce0de6e88dcff70662f77965214bf5ad0cc7e07bc4fae72c40d0 - FTP C2:
ftp[.]melrz[.]com(IP:162[.]0[.]209[.]89) - FTP Ports:
21,12038 - Hosting Check:
hxxp://ip-api[.]com/line/?fields=hosting(resolves to208[.]95[.]112[.]1)
Security teams are advised to block the hash, FTP domain, and suspicious cscript.exe/wscript.exe executions from user-writable locations. The campaign highlights the growing sophistication of fileless malware delivery and credential theft in BEC attacks.
Source: https://gbhackers.com/agent-tesla-malware/
Metropolitan Bank and Trust Company (New York City, NY) cybersecurity rating report: https://www.rankiteo.com/company/metropolitan-bank-and-trust-company-new-york-city-ny-
"id": "MET1787309987",
"linkid": "metropolitan-bank-and-trust-company-new-york-city-ny-",
"type": "Cyber Attack",
"date": "6/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Financial Services',
'location': 'Philippines',
'name': 'Metropolitan Bank and Trust Company '
'(impersonated)',
'type': 'Bank'}],
'attack_vector': 'Email with malicious JScript attachment',
'data_breach': {'data_encryption': 'No (data exfiltrated in plaintext)',
'data_exfiltration': 'Yes (via FTP)',
'file_types_exposed': ['SQLite databases (browser data)',
'Text files (credentials)'],
'personally_identifiable_information': 'Yes (browser '
'credentials, email '
'data)',
'sensitivity_of_data': 'High (PII, financial credentials, '
'OAuth tokens)',
'type_of_data_compromised': ['Browser credentials',
'Email client data',
'Discord tokens',
'Windows Credential Manager '
'data']},
'description': 'A recent business email compromise (BEC) campaign is '
'deploying Agent Tesla v4, an advanced infostealer, using a '
'novel evasion technique: emoji-saturated JScript to conceal '
'malicious code. The attack targets finance teams with fake '
'bank payment lures, impersonating Metropolitan Bank and Trust '
'Company, a legitimate Philippine bank.',
'impact': {'data_compromised': 'Browser credentials, email clients, Discord '
'tokens, Windows Credential Manager',
'identity_theft_risk': 'High (PII and credentials stolen)',
'systems_affected': 'Windows systems with Chromium/Mozilla-based '
'browsers, Outlook, Foxmail, Discord'},
'initial_access_broker': {'entry_point': 'Email with malicious JScript '
'attachment',
'high_value_targets': 'Finance teams'},
'lessons_learned': 'The campaign highlights the growing sophistication of '
'fileless malware delivery and credential theft in BEC '
'attacks. Emoji-obfuscated scripts and reflective '
'injection techniques evade traditional detection methods.',
'motivation': 'Financial gain, credential theft',
'post_incident_analysis': {'corrective_actions': ['Enhance detection for '
'obfuscated scripts',
'Implement behavioral '
'analysis for fileless '
'malware',
'Restrict script execution '
'from user-writable '
'locations'],
'root_causes': ['Lack of detection for '
'emoji-obfuscated scripts',
'Reflective injection bypassing '
'disk-based detection',
'Insufficient monitoring of '
'`cscript.exe`/`wscript.exe` '
'executions']},
'recommendations': ['Block the identified IoCs (JScript hash, FTP domain, IP)',
'Monitor and restrict `cscript.exe`/`wscript.exe` '
'executions from user-writable locations',
'Implement advanced threat detection for fileless malware',
'Educate finance teams on BEC and phishing risks'],
'references': [{'source': 'Cybersecurity Report'}],
'response': {'containment_measures': 'Block the JScript hash, FTP domain, and '
'suspicious `cscript.exe`/`wscript.exe` '
'executions from user-writable '
'locations'},
'title': 'Sophisticated Agent Tesla Campaign Uses Emoji-Obfuscated JScript to '
'Evade Detection',
'type': 'Business Email Compromise (BEC)'}