New Agent Tesla malware version uses emoji obfuscation to evade detection

A new version of the Agent Tesla malware has been identified with enhanced features designed to bypass security measures and steal user credentials. This updated infostealer, version 4, was observed being distributed through sophisticated business email compromise (BEC) attacks specifically targeting finance departments, according to KnowBe4. The malware employs a novel obfuscation technique using embedded Unicode emoji characters within its code, as reported by Infosecurity Magazine.

The latest Agent Tesla campaign utilizes a JScript dropper that incorporates Unicode emoji characters to disrupt signature-based detection and obscure the malicious code. Once executed, the malware injects its payload directly into memory, preventing detection by file-based scanners. It is further obfuscated using ConfuserEx, disguised as a Python installer, and includes debugger detection to avoid analysis.

Before harvesting credentials from over 40 applications, it establishes a hardware fingerprint for persistent tracking and disables connection validation to maintain covert communication with its command and control infrastructure. Exfiltrated data, including system details, is rapidly sent to a threat actor-controlled FTP server. Researchers recommend updating email security rules and implementing YARA rules that detect both emoji patterns and JScript-specific calls to mitigate this threat.

Source: Infosecurity Magazine