AgentTesla Spreads Via CHM & PDF Files In New Attacks

This report details active campaigns distributing the AgentTesla information-stealer through Gzip-compressed CHM files and malicious PDFs that execute encoded PowerShell to download a .NET loader DLL which decrypts and injects AgentTesla; the analysis includes the full infection chain, TTPs (PowerShell, DLL loader, process injection, persistence), multiple IOCs (hashes, domains, IP), and mitigation recommendations.