Threats Tagged 'agent tesla - s0331'

A global phishing campaign since March 2026 uses fileless techniques and low-detection Lua-based loaders disguised as TrueType Font (.ttf) files to deploy malware such as Agent Tesla, Remcos, XWorm, and Best Private LOGGER. The campaign employs obfuscated JavaScript to execute AutoIt or LuaJIT interpreters with advanced anti-analysis methods including custom ROT ciphers, decoy memory allocation, and reflective in-memory shellcode execution. The threat actors impersonate well-known companies to lure victims into opening malicious archives. Over time, the campaign has evolved to include API unhooking and sophisticated debugging countermeasures, ultimately infecting victims with Remote Access Trojans and infostealers that enable full system compromise and data theft.

A sophisticated phishing campaign was identified distributing multiple malware families through a multi-stage loader utilizing steganography and fileless techniques. The infection chain begins with archive attachments containing files disguised as financial documents, primarily targeting Indian organizations using names related to GST, NEFT, RTGS, and IMPS transactions. The loader employs in-memory execution to avoid disk-based artifacts and uses embedded .NET Bitmap objects to conceal payloads. Various malware families have been deployed including Remcos RAT, Agent Tesla, MassLogger, Phantom Stealer, Dark Cloud, Red Line Stealer, Snake keyloggers, Formbook, and xworm. The final payloads establish persistence through registry Run keys, perform process hollowing, steal browser credentials, record audio and webcam, and exfiltrate data to command-and-control infrastructure. The campaign exhibits characteristics of a loader-as-a-service operation serving multiple threat actors globally.

MediumMalwareBritish Indian Ocean TerritoryIndia#fileless#loader-as-a-service#steganography