New Agent Tesla Malware Variant Boosts Evasion Capabilities

KnowBe4 researchers identified an active Agent Tesla v4 infostealer campaign using a sophisticated BEC lure to deliver a JScript dropper that embeds Unicode emoji to bypass signature detection; the dropper uses DonutLoader for reflective PE injection so the final Agent Tesla binary never touches disk. The malware is obfuscated (ConfuserEx), includes anti-debugging checks, creates persistent hardware fingerprints, steals credentials from over 40 applications, logs keystrokes and clipboard data, and rapidly exfiltrates harvested data to an attacker-controlled FTP server.