Back Scworld

New Agent Tesla malware version uses emoji obfuscation to evade detection

Scworld • August 21, 2026

A new version of the Agent Tesla malware has been identified with enhanced features designed to bypass security measures and steal user credentials. This updated infostealer, version 4, was observed being distributed through sophisticated business email compromise (BEC) attacks specifically targeting finance departments, according to KnowBe4. The malware employs a novel obfuscation technique using embedded Unicode emoji characters within its code, as reported by Infosecurity Magazine.

The latest Agent Tesla campaign utilizes a JScript dropper that incorporates Unicode emoji characters to disrupt signature-based detection and obscure the malicious code. Once executed, the malware injects its payload directly into memory, preventing detection by file-based scanners. It is further obfuscated using ConfuserEx, disguised as a Python installer, and includes debugger detection to avoid analysis.

Before harvesting credentials from over 40 applications, it establishes a hardware fingerprint for persistent tracking and disables connection validation to maintain covert communication with its command and control infrastructure. Exfiltrated data, including system details, is rapidly sent to a threat actor-controlled FTP server. Researchers recommend updating email security rules and implementing YARA rules that detect both emoji patterns and JScript-specific calls to mitigate this threat.

Source: Infosecurity Magazine

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Agent Tesla Malware Variant Uses Emojis for Evasion in BEC Campaign A new variant of the Agent Tesla malware, identified as version 4, employs Unicode emoji characters to obfuscate its JScript dropper in a business email compromise (BEC) campaign targeting finance departments. The malware impersonates the Metropolitan Bank and Trust Company in a forwarded email, urging recipients to confirm an attachment. This sophisticated attack method allows the malware to evade traditional detection mechanisms by executing filelessly, meaning the final payload does not touch the filesystem. Agent Tesla v4 is designed to steal credentials from over 40 applications, including browsers and email clients, and exfiltrate them to a threat actor-controlled domain. Security experts recommend updating email security protocols to mitigate the risk of this malware. The malware also creates a persistent hardware fingerprint, allowing attackers to track victims across reinstalls or IP changes. The use of obfuscation techniques makes it challenging for security teams to analyze and detect the malware effectively. 7 sources 70

Extracted Entities

New Agent Tesla malware version uses emoji obfuscation to evade detection

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (4)

Tools (2)