Phishing‑Led Agent Tesla Campaign Uses Process Hollowing and Anti‑Analysis to Evade Detection

This report describes a phishing‑led Agent Tesla campaign that uses a RAR‑attached JScript loader to fetch AES‑encrypted PowerShell, performs in‑memory decryption and process hollowing into aspnet_compiler.exe, applies anti‑analysis checks, and harvests credentials and system data for exfiltration via attacker SMTP servers, illustrating advanced fileless and evasion techniques.