Hackers Hide Agent Tesla Malware Behind Emojis to Steal Browser and Email Passwords

Gbhackers •Mayura Kathir • August 21, 2026

A business email compromise campaign is using emoji-filled JScript to conceal an Agent Tesla v4 infostealer designed to steal browser, email, and messaging credentials. The operation pairs a convincing bank-payment lure with a fileless execution chain that keeps the final malware payload out of sight of traditional disk-based scanning. The messages masquerade as internal forwarded […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Agent Tesla Malware Variant Uses Emojis for Evasion in BEC Campaign A new variant of the Agent Tesla malware, identified as version 4, employs Unicode emoji characters to obfuscate its JScript dropper in a business email compromise (BEC) campaign targeting finance departments. The malware impersonates the Metropolitan Bank and Trust Company in a forwarded email, urging recipients to confirm an attachment. This sophisticated attack method allows the malware to evade traditional detection mechanisms by executing filelessly, meaning the final payload does not touch the filesystem. Agent Tesla v4 is designed to steal credentials from over 40 applications, including browsers and email clients, and exfiltrate them to a threat actor-controlled domain. Security experts recommend updating email security protocols to mitigate the risk of this malware. The malware also creates a persistent hardware fingerprint, allowing attackers to track victims across reinstalls or IP changes. The use of obfuscation techniques makes it challenging for security teams to analyze and detect the malware effectively. 6 sources 70

Extracted Entities

Hackers Hide Agent Tesla Malware Behind Emojis to Steal Browser and Email Passwords

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)