A business email compromise (BEC) campaign targeting finance departments is delivering Agent Tesla v4 through a payment-themed phishing attachment.
The malware uses Unicode emoji characters to hide malicious JScript code, then launches the infostealer through a fileless execution chain designed to evade traditional security controls.
The campaign impersonates Metropolitan Bank and Trust Company, a legitimate Philippine financial institution. The email resembles a forwarded wire-transfer conversation and urges recipients to review an attached document and respond quickly.
This combination of authority, realistic business language and time pressure is designed to persuade finance employees to open the attachment.
The file, named “SWIFT Payment Maker 103 – 10.06.26.JS,” is approximately 6.94 MB. Its large size is caused by heavy obfuscation. Hearts, water droplets and other Unicode emoji characters are embedded throughout the script.
Windows Script Host ignores these characters during interpretation, allowing the underlying JScript logic to execute while disrupting basic string-based detection and making manual inspection difficult.
The sample does not depend on a conventional Base64-and-eval execution pattern or an additional payload download.
Sign up and Repeat your Request
After execution, the script writes two files to C:\Users\Public\Libraries\. One is a 32-bit .NET loader, while the second uses a .ttf extension but is actually an encoded payload blob.
The loader processes this data through DonutLoader shellcode and reflectively injects the final MSIL payload into memory. As a result, the Agent Tesla binary does not need to be stored on disk, reducing the effectiveness of file-focused scanning.
The payload is a ConfuserEx-obfuscated .NET 4.0 binary. Its metadata falsely identifies it as “Python 3.11.3 (64-bit)” and lists the Python Software Foundation as the company.
However, its actual architecture is 32-bit x86 and its runtime characteristics do not match a legitimate Python installer.
Before collecting data, the malware performs several anti-analysis checks. These include debugger detection, cloud-hosting IP checks, timing-based virtual-machine detection, sandbox DLL enumeration and WMI queries for VMware, VirtualBox and Hyper-V indicators.
If the environment appears to belong to a researcher or automated sandbox, the malware exits. Similar Agent Tesla campaigns have also used script-based delivery, in-memory execution and virtualization checks to avoid analysis.
Agent Tesla contains 21 credential-harvesting modules. These target 27 Chromium-based browsers and 13 Mozilla-based browsers, including Chrome, Edge, Brave, Opera, Vivaldi, Firefox and Thunderbird.
The malware extracts browser master keys, decrypts Chrome v10 and v11 credentials using DPAPI and AES-GCM, and reads locked SQLite databases through custom parsing and file-handle techniques, knowbe4 said.
Additional modules target Outlook, Foxmail, Discord, Thunderbird contacts and Windows Credential Manager. Discord LevelDB files are searched for OAuth2 session tokens, which may allow attackers to reuse authenticated sessions without entering the victim’s password.
The malware also includes functional keylogging and clipboard-capture components, although those features are disabled in the analyzed build.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
 campaign targeting finance departments is delivering Agent Tesla v4 through a payment-themed phishing){kind=link}