CTI · corroborated · 2026-08-22

Agent Tesla Malware Campaign Uses Emoji Obfuscation to Steal Credentials

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1059 Command and Scripting Interpreter Execution
• T1027 Obfuscated Files or Information Stealth
• T1555 Credentials from Password Stores Credential Access

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Agent Tesla v4 Emoji-Obfuscated JScript Credential Theft
id: 5c935838-0738-4756-b7c9-147f511beb7b
status: experimental
description: >
    Detects Agent Tesla v4 infostealer delivery via emoji-obfuscated JScript
    in a BEC campaign impersonating Metropolitan Bank and Trust Company.
    The malware uses Unicode emoji characters (hearts, water droplets) to
    obfuscate JScript logic, then launches through a fileless execution chain
    via wscript.exe to steal browser, email, and messaging credentials.
    The lure attachment is named "SWIFT Payment Maker 103" with a .JS extension.
references:
    - https://gbhackers.com/agent-tesla-malware/
    - https://cyberpress.org/sign-up-and-repeat-your-request/
author: Tia N. List
date: 2026/08/22
tags:
    - attack.t1566
    - attack.t1059
    - attack.t1027
    - attack.t1555
logsource:
    category: process_creation
    product: windows
detection:
    selection_wscript_js:
        Image|endswith: '\wscript.exe'
        CommandLine|contains|all:
            - '.js'
            - 'SWIFT'
    selection_wscript_payment:
        Image|endswith: '\wscript.exe'
        CommandLine|contains|all:
            - '.js'
            - 'Payment'
    selection_mshta_js:
        Image|endswith: '\mshta.exe'
        CommandLine|contains|all:
            - '.js'
            - 'SWIFT'
    condition: 1 of selection_*
falsepositives:
    - Legitimate SWIFT payment processing scripts triggered via wscript (unlikely in production)
    - Finance department automation using JScript with payment-related filenames
level: high

References

• https://gbhackers.com/agent-tesla-malware/
• https://cyberpress.org/sign-up-and-repeat-your-request/