Agent Tesla Variant Counters Detection With Emoji

Finance departments are in the crosshairs of a new Agent Tesla variant that packs fresh evasion tricks, according to research from KnowBe4. The cybersecurity firm detailed how the version 4 infostealer, delivered via a business email compromise lure, uses Unicode emoji characters scattered through its code to slip past security tools and credential-stealing routines that sweep more than 40 applications.

New Agent Tesla Campaign Details

KnowBe4 researchers observed the attempted delivery of Agent Tesla v4 in an email designed as a forwarded thread that presented as internal correspondence sent to an account's contact. The attackers spoofed the address of a legitimate Philippines-based commercial bank, Metropolitan Bank and Trust Company, to make the message look credible.

The email thread was structured to resemble an in-progress discussion the recipient had been brought into late, with a direct instruction to confirm an attached document and reply. This social engineering approach aims to trick finance staff into opening the malicious attachment.

Emoji Obfuscation Technique

A novel obfuscation method sits at the heart of this campaign: Unicode emoji characters, such as hearts and water droplets, are interleaved throughout the JScript dropper's code body. This technique disrupts string-based signature matching and makes the code visually noisy enough to defeat casual review by analysts.

The JScript dropper can be launched with a simple initial open-with dialog. Once launched, it writes two files to C:\Users\Public\Libraries\, one of which is a misdirection, while the other passes the extension into DonutLoader shellcode for reflective portable executable (PE) injection. This means the final Agent Tesla binary never touches the filesystem, so file-based scanners cannot detect it.

Defense Evasion Capabilities

Agent Tesla v4 includes several defense evasion capabilities. It is intentionally scrambled using an obfuscator tool called ConfuserEx, making it nearly unreadable for analysis. The malware's assembly also presents itself as a Python installer in its embedded metadata, a trick to mislead investigators.

In addition, it uses a standard Windows function as its first line of defense to detect if it is being watched by a debugger, and stops running if it finds one to avoid analysis. Before harvesting credentials, the malware creates a persistent hardware fingerprint, allowing attackers to track victims consistently across OS reinstalls or IP rotations.

Credential Theft and Exfiltration

The malware is designed to sweep credentials from various sources, including web browsers, messaging platforms, and native Windows credential repositories. It can also intercept keystrokes using its keylogger and clipboard tool. All exfiltrated files include a system fingerprint header with timestamp, username, computer name, OS name, CPU, RAM, public IP, and the MD5 hardware ID.

KnowBe4 noted that the credential dump lands on the attacker's FTP server within seconds of execution, with no delayed staging. The exfiltration happens via a file transfer mechanism to a single threat actor-controlled domain.

Mitigation Advice

The KnowBe4 blog, published on August 20, noted that the emoji-obfuscation approach in the JS dropper does not survive any YARA rule that looks for the Unicode code points used alongside JScript-specific patterns. The researchers advised security teams to update their email security rules to catch Agent Tesla before it can harvest credentials.

"A rule matching both the emoji distribution pattern and WScript.Shell or CreateObject calls will catch this family."

— the KnowBe4 researchers said in the blog post.

The research highlights the ongoing evolution of infostealer malware and the need for layered defenses that go beyond traditional signature-based detection.