New Agent Tesla Malware Variant Uses Emojis for Evasion in BEC Attacks

A new variant of Agent Tesla malware, identified as version 4, has been observed using Unicode emoji characters to obfuscate its JScript dropper in business email compromise (BEC) campaigns targeting finance departments. This sophisticated attack method involves spoofing the email address of Metropolitan Bank and Trust Company to lure victims into executing the malware. Once activated, the malware can extract credentials from over 40 applications and exfiltrate them to a threat actor-controlled domain. The malware employs advanced evasion techniques, including file-less execution and defense mechanisms against analysis. Security experts recommend updating email security measures to detect this variant before it can harvest sensitive information. The attack's scope is significant, given its targeting of financial institutions and the potential for widespread credential theft.

Key Points: • Agent Tesla v4 uses Unicode emojis to evade detection in BEC attacks. • The malware targets finance departments, impersonating a legitimate bank. • It can harvest credentials from over 40 applications and employs advanced evasion techniques.