Hackers Exploiting MS Excel Vulnerability to Spread Agent Tesla Malware

Zscaler and other researchers observed active phishing campaigns using invoice-themed Excel attachments to exploit CVE-2017-11882 and deliver Agent Tesla via a multi-stage chain that includes an obfuscated VBS downloader, steganographic JPG containing a Base64-encoded DLL, and DLL injection into RegAsm.exe; the report also highlights related phishing and stealer campaigns (RedLine, Vidar) and credential/2FA theft schemes.