Attackers have deployed a refined technique to conceal Agent Tesla malware in business email compromise (BEC) campaigns, using Unicode emojis embedded in JScript droppers. The method aims at finance teams, tricking them with what looks like routine payment documents that are actually malicious scripts packed with emoji clutter. The exploit demonstrates how malware operators are getting creative to bypass detection and target high-value financial data. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-agent-tesla/))
In the latest activity, attackers send emails that appear to come from Metropolitan Bank and Trust Company, urging recipients to review a forwarded wire-transfer attachment. The file, labeled as a SWIFT payment document, is actually a 6.94 MB JavaScript file that initiates a hidden chain of events. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-agent-tesla/)) Researchers identified the operation as Agent Tesla v4. The trick enables the final credential-stealing payload to avoid storage on disk until it’s ready, complicating detection efforts. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-agent-tesla/))
What makes this attack especially deceptive is the use of Unicode emojis—like hearts and water droplets—scattered throughout the code. Although Windows Script Host ignores these characters when executing the code, they make the file visually confusing and harder to catch with simple signature-based detection or casual inspection. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-agent-tesla/)) The dropper writes a loader and a font-disguised file into a public Libraries folder, then uses “DonutLoader” shellcode to load the final payload into memory. That avoids leaving clear file artifacts on disk. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-agent-tesla/))
What Agent Tesla Steals and How It Evades Detection
After deployment, the malware seeks credentials from a wide array of sources: 27 Chromium-based browsers, 13 Mozilla-based browsers, desktop email clients like Outlook and Thunderbird, messaging apps such as Discord, and Windows Credential Manager. It also grabs browser logins, messaging data, and other secrets to facilitate account takeover, follow-on phishing, or payment fraud. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-agent-tesla/))
Before exfiltrating data, Agent Tesla uses checks to see if it’s running inside sandboxes, detecting virtualization, or under debugging. If it detects those environments, it terminates itself to avoid revealing behavior. Features like screen capture, clipboard logging, and keylogging are part of its arsenal—even if some samples arrive with those modules disabled. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-agent-tesla/))
Defensive Measures & Indicators to Watch
Key indicators of compromise (IoCs) include a JScript attachment named something like “SWIFT Payment Maker 103 – 10.06.26.JS,” its SHA-256 hash, the impersonated bank name, and the specific dropped files (a .exe loader and a .ttf font-disguised blob) placed in the user’s public Libraries folder. Domains and FTP hosts used for C2 and data exfiltration show up, along with embedded plaintext credentials in the configuration. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-agent-tesla/))
Security operations should tighten policies surrounding script attachments (especially .js files), scrutinize emails spoofing known brands, and verify payment requests via separate communication channels. Detection teams should monitor anomalous in-memory .NET loading activities, FTP traffic to uncommon hosts, and unusual Unicode code points in script files. When compromised, rotate credentials for browsers, email accounts, messaging, and Windows Vault. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-agent-tesla/))
This campaign underscores how threat actors are combining phishing with obfuscation and memory-only execution to evade defenses. Even without disk artifacts, attackers can extract valuable credentials immediately and use them for broader attacks. ([cybersecuritynews.com](https://cybersecuritynews.com/hackers-hide-agent-tesla/))
Watching for these tactics isn’t just about catching one attack—it’s about catching a new breed of stealthy, low-footprint malware campaigns that weaponize visual obfuscation and valid-seeming attachments to slip past traditional protections.
