Agent Tesla BEC Campaign Uses Emoji-Obfuscated JScript to Steal Credentials From 40+ Apps
Brief
A business email compromise (BEC) campaign targeting finance departments is delivering Agent Tesla v4 through a payment-themed phishing attachment.
The malware uses Unicode emoji characters to hide malicious JScript code , then launches the infostealer through a fileless execution chain designed to evade traditional security controls.
The campaign impersonates Metropolitan Bank and Trust Company, a legitimate Philippine financial institution. The email resembles a forwarded wire-transfer conversation and urges recipients to review an attached document and respond quickly.
This combination of authority, realistic business language and time pressure is designed to persuade finance employees to open the attachment.
The file, named “SWIFT Payment Maker 103 – 10.
- 26. JS,” is approximately 6. 94 MB. Its large size is caused by heavy obfuscation.