Thousands of Australian Businesses Targeted With 'Reliable' Agent Tesla RAT

Check Point researchers observed a high-volume phishing campaign that targeted primarily Australian (and some U.S.) businesses by distributing the Agent Tesla RAT via booby-trapped email attachments. Operators using infrastructure hosted with Plesk/RoundCube and delivery obfuscation (Cassandra Protector, converting .NET payloads to ISO/.img) ran mass spam runs from prepared lists (e.g., "AU B2B Lead.txt"); the campaign enabled credential and data theft, showed integration with Telegram/Discord for exfiltration/command, and involved actors tracked as "Bignosa" and "Gods."