Hackers Hide Agent Tesla JScript Behind Unicode Emojis to Evade Detection

Cybersecuritynews •Tushar Subhra Dutta • August 21, 2026

Hackers are using Unicode emoji characters to hide an Agent Tesla JScript dropper in a business email compromise campaign aimed at finance teams. The tactic turns a payment-related attachment into a difficult-to-read script while leaving malicious instructions ready for Windows to execute. A forwarded wire-transfer email impersonates Metropolitan Bank and Trust Company. It urges recipients […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Agent Tesla Malware Variant Uses Emojis for Evasion in BEC Campaign A new variant of the Agent Tesla malware, identified as version 4, employs Unicode emoji characters to obfuscate its JScript dropper in a business email compromise (BEC) campaign targeting finance departments. The malware impersonates the Metropolitan Bank and Trust Company in a forwarded email, urging recipients to confirm an attachment. This sophisticated attack method allows the malware to evade traditional detection mechanisms by executing filelessly, meaning the final payload does not touch the filesystem. Agent Tesla v4 is designed to steal credentials from over 40 applications, including browsers and email clients, and exfiltrate them to a threat actor-controlled domain. Security experts recommend updating email security protocols to mitigate the risk of this malware. The malware also creates a persistent hardware fingerprint, allowing attackers to track victims across reinstalls or IP changes. The use of obfuscation techniques makes it challenging for security teams to analyze and detect the malware effectively. 7 sources 70

Extracted Entities

Hackers Hide Agent Tesla JScript Behind Unicode Emojis to Evade Detection

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)