Reported by 2 outlets
Agent Tesla Malware Campaign Uses Emoji Obfuscation to Steal Credentials
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.55 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Hackers Hide Agent Tesla Malware Behind Emojis to Steal Browser and Email Passwords
gbhackers.com · 53d ago · August 21st, 2026
A business email compromise campaign is using emoji-filled JScript to conceal an Agent Tesla v4 infostealer designed to steal browser, email, and messaging credentials. The operation pairs a convincing bank-payment lure with a fileless execution chain that keeps the final malware payload out of sight of traditional disk-based scanning. The messages masquerade as internal forwarded […] The post Hackers Hide Agent Tesla Malware Behind Emojis to Steal Browser and Email Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Agent Tesla BEC Campaign Uses Emoji-Obfuscated JScript to Steal Credentials From 40+ Apps
cyberpress.org · 53d ago · August 21st, 2026
A business email compromise (BEC) campaign targeting finance departments is delivering Agent Tesla v4 through a payment-themed phishing attachment. The malware uses Unicode emoji characters to hide malicious JScript code , then launches the infostealer through a fileless execution chain designed to evade traditional security controls. The campaign impersonates Metropolitan Bank and Trust Company, a legitimate Philippine financial institution. The email resembles a forwarded wire-transfer conversation and urges recipients to review an attached document and respond quickly. This combination of authority, realistic business language and time pressure is designed to persuade finance employees to open the attachment. The file, named “SWIFT Payment Maker 103 – 10.06.26.JS,” is approximately 6.94 MB. Its large size is caused by heavy obfuscation. Hearts, water droplets and other Unicode emoji characters are embedded throughout the script. Windows Script Host ignores these characters during interpretation, allowing the underlying JScript logic to execute while disrupting basic string-based detection and making manual inspection difficult. The sample does not depend on a conventional Base64-and-eval execution pattern or an additional payload download. Sign up and Repeat your Request After execution, the script writes two files to C:\Users\Public\Libraries\ . One is a 32-bit .NET loader, while the second uses a .ttf extension but is actually an encoded payload blob. The loader processe