Cascading Shadows: An Attack Chain Approach to Avoid Detection and Complicate Analysis

In December 2024, analysts uncovered a multi-stage phishing campaign delivering Agent Tesla variants via emailed archives containing a .jse downloader that fetches a Base64 PowerShell payload; subsequent stages used either .NET or AutoIt compiled droppers to decrypt payloads and inject malware into legitimate processes (RegAsm/RegSvcs), with the report detailing AutoIt debugging, shellcode execution, IOCs (hashes, payload URLs, and FTP credentials), and recommended detections and mitigations via Palo Alto Networks products and Unit 42.