“A rule matching both the emoji distribution pattern and WScript.Shell or CreateObject calls will catch this family,” the KnowBe4 researchers said.
The BEC lure and how the delivery unfolded
KnowBe4 analysts observed Agent Tesla version 4 delivered in a targeted business email compromise (BEC) campaign aimed at finance departments. The message arrived as a forwarded thread styled to look like an internal correspondence and spoofed the address of the Philippines-based Metropolitan Bank and Trust Company. The thread asked the recipient to confirm an attached document and reply — a simple interaction that, when combined with the attachment, launched the infection chain.
Emoji obfuscation inside the JScript dropper
The initial payload is a JScript dropper whose body is interleaved with Unicode emoji characters — for example, hearts and water droplets — embedded throughout the code. According to the researchers, those characters both disrupt string-based signature matching and make casual review of the code visually noisy. KnowBe4 reported that the emoji-obfuscation tactic does not survive a YARA rule that looks for the Unicode code points used alongside JScript-specific patterns, and advised creating rules that combine the emoji distribution with JScript API calls such as WScript.Shell or CreateObject to detect the family.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDonutLoader, reflective injection, and fileless persistence
When executed, the JScript writes two files to C:\Users\Public\Libraries\. One file is a misdirection; the other is passed into DonutLoader shellcode which performs reflective portable executable (PE) injection. Because the final Agent Tesla binary is injected into memory rather than written as a normal file, KnowBe4 highlights that the binary “never touches the filesystem” and can evade file-based scanners. The assembly is further obfuscated with a tool named ConfuserEx and contains embedded metadata that presents the payload as a Python installer. The malware also calls a standard Windows function to detect debuggers and will cease running if it finds one.
Credential harvesting, keystroke capture, and rapid exfiltration
Agent Tesla v4 is configured to sweep credentials from more than 40 applications, including web browsers, messaging platforms and native Windows credential repositories. It also logs keystrokes and captures clipboard contents. All exfiltrated files carry a system fingerprint header that includes timestamp, username, computer name, OS name, CPU, RAM, public IP and an MD5 hardware ID. KnowBe4 observed that credential dumps land on the attacker-controlled FTP server within seconds of execution, with no delayed staging, and that the malware creates a persistent hardware fingerprint so attackers can track victims across system reinstalls or IP rotations.
Network behavior and defensive evasions
Among Agent Tesla v4’s network and persistence techniques, KnowBe4 reports the malware disables validation for outgoing connections to keep communication with command-and-control infrastructure unhindered and to avoid triggering security alerts or errors. The researchers also identified several other persistence mechanisms embedded in the payload that help it remain active on compromised systems.
What this means for security teams, finance departments, and incident responders
- Security teams: Update email security rules to look for forwarded-thread BEC lures spoofing trusted organizations, and deploy YARA or similar detection logic that pairs the emoji Unicode distribution with JScript artifacts such as WScript.Shell or CreateObject, per KnowBe4’s recommendation.
- Finance departments: Be cautious with unsolicited forwarded threads requesting confirmation or review of attached documents — the campaign specifically targeted finance staff and used plausible internal-thread context to induce interaction.
- Incident responders: Treat JScript droppers that write to C:\Users\Public\Libraries\ and invoke reflective loaders as high risk, and check for rapid FTP exfiltration and the presence of system fingerprint headers in outbound data as indicators of compromise.
KnowBe4 published its analysis on August 20 and emphasized that a targeted update to detection rules — combining emoji codepoint patterns with JScript-specific calls — will catch this variant in the dropper stage. The technical chain observed in this campaign — emoji-obfuscated JScript, DonutLoader reflective injection, ConfuserEx obfuscation, hardware fingerprinting, and near-immediate FTP exfiltration of credentials — sketches a compact but resilient infostealer designed to steal and transmit credentials quickly while minimizing forensic traces.
Source: https://www.infosecurity-magazine.com/news/agent-tesla-malware-evasion/
