New Agent Tesla Malware Variant Uses Emojis for Evasion in BEC Campaign

• •Agent Tesla v4 uses Unicode emojis to obfuscate its JScript dropper in BEC attacks.
• •The malware targets finance departments, impersonating a legitimate bank to deceive victims.
• •It can steal credentials from over 40 applications and employs fileless execution to evade detection.

A new variant of the Agent Tesla malware, identified as version 4, employs Unicode emoji characters to obfuscate its JScript dropper in a business email compromise (BEC) campaign targeting finance departments. The malware impersonates the Metropolitan Bank and Trust Company in a forwarded email, urging recipients to confirm an attachment. This sophisticated attack method allows the malware to evade traditional detection mechanisms by executing filelessly, meaning the final payload does not touch the filesystem. Agent Tesla v4 is designed to steal credentials from over 40 applications, including browsers and email clients, and exfiltrate them to a threat actor-controlled domain. Security experts recommend updating email security protocols to mitigate the risk of this malware. The malware also creates a persistent hardware fingerprint, allowing attackers to track victims across reinstalls or IP changes. The use of obfuscation techniques makes it challenging for security teams to analyze and detect the malware effectively.