Threat insights 0x22: Agent Tesla

Fake banking documents

The email disguises itself as an official message from a bank, asking the recipient to review important documents. However, its true aim is far more dangerous: it tricks the recipient into opening the attached file, which contains a malicious executable. If the file is run, it infects the system with the Agent Tesla malware, all while the recipient believes they're simply handling routine banking documents:

The threat actor's main goal is to trick the victim into running the payload, which silently installs Agent Tesla malware on their system. Once active, the malware covertly gathers sensitive information and credentials, putting the victim's security at serious risk.

Your inbox is almost full

This email cleverly impersonates the recipient's email service provider, urging them to click a link disguised as information about "storage limits." However, the link leads to a credential-harvesting page, designed to steal the recipient's login details.

Upgrade your inbox

This email deceptively mimics the recipient's email service provider, pressuring them to click a link to upgrade their mailbox to avoid potential service interruptions. But instead of a legitimate upgrade, the link directs them to a credential-harvesting page designed to steal their credentials:

IOCs

Keep up with threat insights

Threat insights is a weekly series where we present you with analysis from samples we collect. Follow us on social media for the latest feed and cybersecurity content. Stay informed and stay safe!

Get more insights like this