Anatomy of an Agent Tesla BEC Attack: From Inbox to In-Memory Infostealer

This report analyzes a BEC phishing campaign delivering Agent Tesla v4 through an emoji-obfuscated JScript dropper that uses DonutLoader for reflective in-memory .NET injection; the ConfuserEx-obfuscated infostealer performs extensive anti-analysis checks, harvests credentials from browsers, email clients, Discord and Windows Vault, and exfiltrates data via FTP to ftp.melrz.com, with full IOCs and remediation recommendations provided.