Loading story…
Breakglass Intelligence reported a credential-stealing campaign delivering AgentTesla v3 through spear-phishing emails masquerading as purchase orders or request-for-quote documents. The infection chain used a heavily obfuscated JavaScript or JScript attachment that launched XOR-decrypted PowerShell, reflectively loaded a .NET component identified as DEV.dll, and performed process hollowing into aspnet_compiler.exe to run the final payload. The malware established persistence through %APPDATA%\GLOZVJ\GLOZVJ.exe, a Startup shortcut, and an HKCU\Run value named GLOZVJ, while a watchdog loop re-injected the payload if the host process was terminated.
The payload harvested credentials and data from more than 40 browsers, over 20 email clients, FTP and VPN software, Discord tokens, Windows Credential Manager, clipboard contents, screenshots, and keystrokes, then exfiltrated the data over SMTP through mail.cottondreams.org on a Ukrainian VPS at 31.222.235.198. Reports said the server used Exim, Dovecot, nginx, OpenSSH, ProFTPD, and FASTPANEL, and that plaintext SMTP credentials and weak certificate hygiene exposed poor operator security. Breakglass linked the infrastructure to activity dating back to domain registration in March 2024 and related samples seen since January 2025, assessing the operation as a persistent, financially motivated AgentTesla MaaS campaign with possible overlap with West African BEC-style tradecraft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-14, Breakglass published analysis of the five-domain PS.Maloader campaign, describing Cloudflare-shielded infrastructure, method-based content switching on portal-idos.network, exposed registrant details, and banker-style stage-2 behavior. The report assessed it as a low-detection MaaS operation likely distributed through a single phishing wave.
On 2026-03-12, Breakglass published detailed reporting on the AgentTesla v3 campaign, including persistence mechanisms, plaintext SMTP credentials, and exfiltration via mail.cottondreams.org on Ukrainian-hosted infrastructure at 31.222.235.198. The report also assessed the operation as likely tied to an AgentTesla MaaS operator or subscriber.
On 2026-03-12, Breakglass observed a fully weaponized AgentTesla v3 campaign delivered through spear-phishing emails with fake purchase order or RFQ-themed JavaScript attachments. The five-stage chain used obfuscated JavaScript, PowerShell, a reflective .NET loader, and process hollowing into aspnet_compiler.exe.
Between March 4 and March 14, 2026, a malware-as-a-service loader campaign used five newly registered domains to deliver nearly identical PowerShell stage-1 droppers. The infrastructure was fronted by Cloudflare and used rotating domains, including a typosquat of the idOS staking portal.
Breakglass reported related AgentTesla campaign samples and activity tied to the same infrastructure beginning in January 2025. This indicated the operator had been running the campaign or closely related activity for over a year.
The domain cottondreams.org, later used for SMTP exfiltration in an AgentTesla v3 campaign, was registered in March 2024. Breakglass linked this registration to a long-running financially motivated operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzed multiple **AgentTesla** infection chains that begin with heavily obfuscated **JScript** files executed by `wscript.exe`, often delivered as phishing attachments and, in one case, an RFQ-themed spear-phishing lure named **"RFQ No 600002389875 RG724.JS"**. The scripts used layered evasion including centralized string arrays, index arithmetic, control-flow flattening, junk code, string reversal, delimiter noise, and a regex-based anti-debugging technique. In the Firebase-backed variant, the dropper retrieved a second-stage PowerShell payload from a **Google Firebase Storage** bucket, saved it to `C:\Temp\` under a randomized filename, and launched it with execution-policy bypass and hidden-window options, allowing malicious traffic to blend with trusted Google infrastructure. A related loader variant dropped PE payloads disguised as `.png` files into `C:\Users\Public\`, executed PowerShell in memory through a base64-decoded `IEX` command, and established persistence via the **`HKCU\Run`** registry key. The activity was linked to commodity cybercrime and the **AgentTesla** credential-theft family, which is commonly associated with credential harvesting, keylogging, screenshot capture, and data exfiltration over **SMTP**, **FTP/FTPS**, or **HTTP/HTTPS**. Detection remained relatively low across samples, with reports citing **14/76** and **20/76** antivirus detections at initial analysis, underscoring the effectiveness of the campaign’s obfuscation and abuse of legitimate cloud services.
Jun 29, 2026
Researchers detailed a phishing-led **Agent Tesla** infection chain that starts with a payment-receipt-themed email attachment and escalates through multiple scripted stages to full compromise. The campaign avoids older Office exploit techniques such as `CVE-2017-11882`, `CVE-2017-0199`, and `CVE-2018-0802`, instead relying on heavily obfuscated Batch and PowerShell loaders to launch payloads in memory, execute hidden scripts, and establish persistence while reducing visibility to traditional defenses. The final VB.NET payload uses anti-debugging, anti-sandbox, and anti-VM checks before performing **process hollowing** into legitimate Windows binaries such as `charmap.exe`. Once active, Agent Tesla steals browser credentials, cookies, autofill data, keystrokes, and screenshots, then exfiltrates the data over channels including SMTP, FTP, and Telegram bots, highlighting the threat posed by fileless execution and in-memory process injection in commodity malware campaigns.
Jun 29, 2026
Phishing emails and malicious websites were used to trick users into launching **PowerShell**-driven malware chains that installed infostealers and stole credentials, clipboard data, and host information. In one case, an EDR alert on a finance user’s device showed `msedge.exe` spawning `powershell.exe`, followed by `curl.exe`, a downloaded DLL, and `rundll32.exe`; the decoded Base64 command used an `IEX` and `Net.WebClient.DownloadString` pattern to retrieve remote code after the user clicked an “Outstanding Invoice — Action Required” lure. The payload was identified as an **AgentTesla** variant, and responders isolated the host, revoked session tokens, reset credentials, and found two additional recipients of the same phishing email, though only one clicked and SmartScreen blocked the download. A related intrusion used a phishing site that instructed victims to open PowerShell as administrator and paste an encoded command copied to the clipboard, leading to the download of a ZIP archive and execution of `updater.exe`, a packed PyInstaller-based **DXI Infostealer** sample. The malware used a **UAC bypass** via the `ms-settings` registry hijack and `computerdefaults.exe`, added Microsoft Defender exclusions, disabled protections, collected system, network, antivirus, clipboard, screenshot, and browser-related data, and packaged the results with `rar.exe` before exfiltrating them through the **Telegram API** as command-and-control. The activity showed a consistent pattern of social engineering, PowerShell abuse, defense evasion, staged payload delivery, and HTTPS or Telegram-based data theft.
Jun 29, 2026