LinkedIn Phishing Campaign Spread Agent Tesla

**Executive summary:** This report documents a LinkedIn-themed phishing campaign that used Yola-hosted lure pages and a separate credential-phishing site to distribute multi-stage .NET payloads (Agent Tesla and a custom info stealer), detailing the unpacking process, malware capabilities (keylogging, clipboard and screen capture, SMTP exfiltration, persistence via registry run keys), IoCs (file hashes, domains, filenames, PDBs), and mapped MITRE ATT&CK techniques.