Inside the Stealthy Agent Tesla Infection Chain

This report details a sophisticated Agent Tesla infostealer campaign that uses phishing archives and heavily obfuscated batch/PowerShell loaders to execute fileless, in-memory payloads, perform process hollowing and inject a VB.NET payload equipped with anti-debugging, anti-sandbox, and anti-VM checks; once established it steals browser credentials, cookies, keylogs and screenshots and exfiltrates data via common protocols, with recommended defenses including EDR capable of detecting process hollowing and comprehensive phishing awareness training.