Hackers Hide Agent Tesla JScript Behind Unicode Emojis to Evade Detection
Brief
Hackers are using Unicode emoji characters to hide an Agent Tesla JScript dropper in a business email compromise campaign aimed at finance teams.
The tactic turns a payment-related attachment into a difficult-to-read script while leaving malicious instructions ready for Windows to execute.
A forwarded wire-transfer email impersonates Metropolitan Bank and Trust Company. It urges recipients to confirm an attachment, using urgency and a believable banking context to get someone to open a 6. 94 MB JavaScript file.
Researchers at KnowBe4 identified the activity and tracked it as an Agent Tesla v4 operation. The attachment, named as a SWIFT payment document, launches a chain that keeps the final credential-stealing program out of sight on the victim’s disk.
The risk extends beyond one stolen password.