A recent report has surfaced, detailing a sophisticated business email compromise (BEC) campaign that employs a highly deceptive technique to deliver a variant of Agent Tesla, an infamous information-stealer. This particular variation utilizes emoji-laden JScript files to obscure its malicious payload effectively, making detection through traditional antivirus systems significantly more challenging.
The campaign cleverly revolves around a convincing lure that mimics legitimate communications regarding bank payments. Recipients are bombarded with emails that appear to be internal correspondences concerning pending wire transfers, compelling them to quickly review an attachment labeled “SWIFT Payment Maker 103 – 10.06.26.JS.” This file, a 6.94 MB JScript document, is presented as essential payment-related documentation, leveraging urgency to increase the likelihood of interaction.
Upon execution, the attachment invokes the Windows Script Host, initiating a complex evasion method characterized by a unique saturation of Unicode emoji characters, such as hearts and droplets. This strategic use of visual noise complicates the process of string-matching detection, effectively obscuring the underlying JScript logic while maintaining its executable capability.
Contrary to many typical malware delivery methods, the JScript threat does not rely on downloading a second-stage payload or employing conventional Base64 and eval execution routines. Instead, it operates through a method known as “fileless execution,” which minimizes the malware’s footprint on disk. During its operation, the dropper writes two files to the public libraries folder on affected systems: a 32-bit .NET loader stored as an executable and an additional file masquerading as a TrueType font (TTF). In reality, this TTF file harbors an encoded Agent Tesla payload, which the loader processes through DonutLoader shellcode for reflective injection into memory.
This chain of operations—moving from JScript to shellcode and then to reflective injection—ensures that the final Agent Tesla binary does not need to be written onto physical disks. This fileless execution technique allows it to evade detection by standard endpoint security measures, which typically focus on file-based scanning. According to threats reported by KnowBe4 Threat Lab, this campaign specifically targets finance teams with emails impersonating the Metropolitan Bank and Trust Company, a recognized bank in the Philippines.
The Agent Tesla malware itself is a .NET executable obfuscated using ConfuserEx. Interestingly, its metadata falsely identifies it as “Python 3.11.3 (64-bit),” despite being a 32-bit x86 .NET binary. Before it begins to harvest sensitive data, the malware employs several anti-analysis checks to evade detection by security measures. These checks include the identification of debugging tools, cloud-hosting IP verification, timing checks for virtual-machine environments, and the use of WMI queries to detect common virtualization platforms like VMware and VirtualBox.
When these checks reveal that the malware is running in a controlled or automated environment, it will terminate its processes to avoid detection. Once operational, Agent Tesla is capable of harvesting information from a wide range of applications, including 27 Chromium-based and 13 Mozilla-based browsers, Outlook, Foxmail, and Discord. Its sophisticated capabilities include retrieving passwords, stealing session tokens, and harvesting data from contacts and credentials stored across affected applications.
One notable method utilized by Agent Tesla is its ability to recover credentials from popular Chromium browsers like Chrome 80+. By extracting the encrypted master key from the Local State file, the malware utilizes Windows DPAPI to unlock it, subsequently decrypting credential blobs using AES-GCM. Furthermore, it can read locked SQLite browser databases, ensuring an extensive data collection from compromised systems.
All data harvested by Agent Tesla is exfiltrated to a designated FTP domain, specifically ftp[.]melrz[.]com, which resolves to an IP address of 162[.]0[.]209[.]89, utilizing the FtpWebRequest with the STOR command for data transfer. Additionally, the malware seeks out Discord LevelDB stores to capture OAuth2 session tokens, essential for account takeovers and bypassing standard authentication practices.
To combat this emerging threat, security teams are advised to block or monitor the identified SHA-256 hash related to the JScript attachment and keep a lookout for any suspicious activities involving the execution of cscript.exe or wscript.exe from user-writable locations. Organizations should approach unexpected JS files—especially those themed around payments—with a heightened level of caution.
In light of this increasingly stealthy delivery method, robust security measures such as attachment sandboxing, restrictions on script execution, enhanced EDR (Endpoint Detection and Response) telemetry for reflective loading, and dedicated training for finance personnel concerning phishing threats have become imperative. By implementing these controls and fostering vigilance regarding potential email scams, organizations can better protect themselves from being ensnared in BEC campaigns that leverage sophisticated tactics.