Loading story…
Researchers analyzed multiple AgentTesla infection chains that begin with heavily obfuscated JScript files executed by wscript.exe, often delivered as phishing attachments and, in one case, an RFQ-themed spear-phishing lure named "RFQ No 600002389875 RG724.JS". The scripts used layered evasion including centralized string arrays, index arithmetic, control-flow flattening, junk code, string reversal, delimiter noise, and a regex-based anti-debugging technique. In the Firebase-backed variant, the dropper retrieved a second-stage PowerShell payload from a Google Firebase Storage bucket, saved it to C:\Temp\ under a randomized filename, and launched it with execution-policy bypass and hidden-window options, allowing malicious traffic to blend with trusted Google infrastructure.
A related loader variant dropped PE payloads disguised as .png files into C:\Users\Public\, executed PowerShell in memory through a base64-decoded IEX command, and established persistence via the HKCU\Run registry key. The activity was linked to commodity cybercrime and the AgentTesla credential-theft family, which is commonly associated with credential harvesting, keylogging, screenshot capture, and data exfiltration over SMTP, FTP/FTPS, or HTTP/HTTPS. Detection remained relatively low across samples, with reports citing 14/76 and 20/76 antivirus detections at initial analysis, underscoring the effectiveness of the campaign’s obfuscation and abuse of legitimate cloud services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Breakglass Intelligence published technical details for the AgentTesla-related droppers, including file hashes, network and process-chain indicators, ATT&CK mappings, and anti-analysis techniques. The Firebase-staged sample showed low VirusTotal detection at 14/76 on 2026-03-12, while the RFQ-themed sample had 20/76 detections at first submission the same day.
A separate Breakglass Intelligence analysis documented an RFQ-themed spear-phishing lure distributing a JScript file named "RFQ No 600002389875 RG724.JS". The script dropped PE payloads disguised as .png files, launched a base64-decoded PowerShell IEX command, and established persistence via the HKCU Run registry key, with static analysis linking it to AgentTesla.
Breakglass Intelligence analyzed a heavily obfuscated Windows Script Host JScript sample used as the first stage of an AgentTesla credential-theft campaign. The script downloaded a second-stage PowerShell payload from a Google Firebase Storage bucket, saved it in C:\Temp\ under a randomized filename, and executed it with PowerShell execution-policy bypass flags.
FortiGuard Labs published threat research detailing a multi-stage AgentTesla campaign. The report appears to predate the later Breakglass analyses and constitutes a distinct technical disclosure about the malware’s delivery and execution chain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence reported a credential-stealing campaign delivering **AgentTesla v3** through spear-phishing emails masquerading as purchase orders or request-for-quote documents. The infection chain used a heavily obfuscated JavaScript or JScript attachment that launched XOR-decrypted PowerShell, reflectively loaded a .NET component identified as `DEV.dll`, and performed process hollowing into `aspnet_compiler.exe` to run the final payload. The malware established persistence through `%APPDATA%\GLOZVJ\GLOZVJ.exe`, a Startup shortcut, and an `HKCU\Run` value named `GLOZVJ`, while a watchdog loop re-injected the payload if the host process was terminated. The payload harvested credentials and data from more than 40 browsers, over 20 email clients, FTP and VPN software, Discord tokens, Windows Credential Manager, clipboard contents, screenshots, and keystrokes, then exfiltrated the data over SMTP through `mail.cottondreams.org` on a Ukrainian VPS at `31.222.235.198`. Reports said the server used Exim, Dovecot, nginx, OpenSSH, ProFTPD, and FASTPANEL, and that plaintext SMTP credentials and weak certificate hygiene exposed poor operator security. Breakglass linked the infrastructure to activity dating back to domain registration in March 2024 and related samples seen since January 2025, assessing the operation as a persistent, financially motivated **AgentTesla MaaS** campaign with possible overlap with West African BEC-style tradecraft.
Jun 29, 2026
Researchers detailed a phishing-led **Agent Tesla** infection chain that starts with a payment-receipt-themed email attachment and escalates through multiple scripted stages to full compromise. The campaign avoids older Office exploit techniques such as `CVE-2017-11882`, `CVE-2017-0199`, and `CVE-2018-0802`, instead relying on heavily obfuscated Batch and PowerShell loaders to launch payloads in memory, execute hidden scripts, and establish persistence while reducing visibility to traditional defenses. The final VB.NET payload uses anti-debugging, anti-sandbox, and anti-VM checks before performing **process hollowing** into legitimate Windows binaries such as `charmap.exe`. Once active, Agent Tesla steals browser credentials, cookies, autofill data, keystrokes, and screenshots, then exfiltrates the data over channels including SMTP, FTP, and Telegram bots, highlighting the threat posed by fileless execution and in-memory process injection in commodity malware campaigns.
Jun 29, 2026
Phishing emails and malicious websites were used to trick users into launching **PowerShell**-driven malware chains that installed infostealers and stole credentials, clipboard data, and host information. In one case, an EDR alert on a finance user’s device showed `msedge.exe` spawning `powershell.exe`, followed by `curl.exe`, a downloaded DLL, and `rundll32.exe`; the decoded Base64 command used an `IEX` and `Net.WebClient.DownloadString` pattern to retrieve remote code after the user clicked an “Outstanding Invoice — Action Required” lure. The payload was identified as an **AgentTesla** variant, and responders isolated the host, revoked session tokens, reset credentials, and found two additional recipients of the same phishing email, though only one clicked and SmartScreen blocked the download. A related intrusion used a phishing site that instructed victims to open PowerShell as administrator and paste an encoded command copied to the clipboard, leading to the download of a ZIP archive and execution of `updater.exe`, a packed PyInstaller-based **DXI Infostealer** sample. The malware used a **UAC bypass** via the `ms-settings` registry hijack and `computerdefaults.exe`, added Microsoft Defender exclusions, disabled protections, collected system, network, antivirus, clipboard, screenshot, and browser-related data, and packaged the results with `rar.exe` before exfiltrating them through the **Telegram API** as command-and-control. The activity showed a consistent pattern of social engineering, PowerShell abuse, defense evasion, staged payload delivery, and HTTPS or Telegram-based data theft.
Jun 29, 2026