Quantum Builder Delivers Agent Tesla RAT with New TTP

Zscaler ThreatLabz details an active Agent Tesla campaign that leverages Quantum Builder to produce malicious LNK/HTA/ISO payloads: spear‑phishing archives drop LNKs that invoke MSHTA to fetch HTA files, which decrypt staged in‑memory PowerShell loaders that download Agent Tesla, perform a CMSTP UAC bypass to run with elevated privileges, set Defender exclusions, and hide the binary; the report includes full technical analysis, IoCs (hashes, URLs, C2 servers), and builder module comparisons.