AgentTesla Malware Targets Users Via Malicious Control Panel

Cyble CRIL analyzed a multi-stage AgentTesla information-stealing campaign that distributes via phishing emails containing a malicious .cpl control-panel file; the CPL executes obfuscated PowerShell which downloads a .NET loader and injects AgentTesla into system processes (RegSvcs.exe, Msbuild.exe). The campaign implements persistence (Startup folder and scheduled tasks), defense-evasion (AMSI and Windows Defender disabling, exclusions), and provides extensive IOCs (file hashes, malicious URL) and a YARA signature for detection.