Data exfiltration in this campaign is handled via the FtpWebRequest protocol, with stolen credentials and contact lists sent to a C2 infrastructure hosted at ftp.melrz.com. This specific operational detail highlights the brazen nature of a new wave of Business Email Compromise (BEC) attacks currently sweeping through corporate finance departments across the globe. By leveraging highly sophisticated social engineering tactics, threat actors are impersonating the Metropolitan Bank and Trust Company to lure unsuspecting employees into a trap. These emails typically carry urgent messages regarding wire transfers or pending payments, designed to trigger an immediate emotional response that overrides standard security caution. Within these messages lies a deceptive JScript file, which, while appearing to be a benign document like a bank statement or a receipt, serves as the primary gateway for a fileless infection process. This methodology allows the attackers to maintain a high degree of stealth while bypassing many traditional scanning tools.
Innovative Evasion and Infection Chain
Visual Noise: The Role of Emoji Obfuscation
The most notable aspect of this campaign is the use of Unicode emojis, such as hearts and droplets, to saturate the malicious JScript code. This visual noise serves as a dual-threat tactic that effectively breaks the pattern-matching capabilities of legacy antivirus software. By flooding the script with non-alphanumeric symbols that possess no inherent logical value to a security scanner, the attackers ensure that the file appears as harmless junk data rather than a dangerous script. This level of obfuscation is particularly effective against signature-based detection engines that are not tuned to interpret such high-density visual symbols within a code context.
Furthermore, this technique makes the code nearly impossible for human analysts to read or reverse-engineer without significant pre-processing. Despite looking like absolute gibberish to the naked eye, the underlying JavaScript logic remains perfectly executable by the Windows Script Host. This allows the malware to hide in plain sight during the initial delivery phase, as security professionals might overlook a file that appears to be corrupted or filled with nonsensical characters. This creative use of encoding demonstrates a deep understanding of how both automated systems and human defenders perceive potential threats.
Memory-Based Defense Bypass: The Execution Chain
Following the execution of the script, the malware avoids downloading payloads through easily flagged encoded commands. Instead, the dropper writes a .NET loader and a disguised data blob to a public directory, mimicking standard system files that one might find in a typical Windows environment. This stage is crucial because it moves the attack away from the initial script and into the realm of compiled binaries, which are often given more leeway by basic endpoint protection. By placing these files in public folders, the malware gains a persistent foothold without needing administrative privileges.
The loader uses specialized shellcode to process the encoded payload and injects it directly into the system’s memory. This reflective injection ensures that the raw binary of Agent Tesla never touches the disk, effectively neutralizing file-centric endpoint security products that monitor for suspicious local files. By existing only in the volatile memory of a running process, the malware leaves a minimal footprint for forensic investigators to follow. This fileless approach has become a hallmark of advanced persistent threats, as it forces defenders to rely on behavioral analysis rather than simple file scanning.
Deep Dive into the Agent Tesla Payload
Sophisticated Deception: Metadata and Sandbox Evasion
The final payload is a heavily obfuscated .NET executable that goes to great lengths to deceive forensic investigators, even forging its metadata to appear as a legitimate Python installation. By mimicking the digital signature and properties of a widely used programming language, the malware attempts to blend in with the thousands of other processes running on a modern workstation. This cosmetic layer of defense is paired with an aggressive internal obfuscation strategy that hides the actual function calls and variable names, making it difficult for automated sandboxes to categorize the behavior of the program correctly.
Before harvesting any data, the malware performs a comprehensive suite of environmental checks to ensure it is not running in a virtual machine. It searches for active debuggers and queries specific system identifiers that are common in laboratory environments. If any sign of a security analysis environment is detected, the malware terminates instantly to prevent its internal logic from being captured and studied. This self-preservation mechanism ensures that the attackers can maintain their operational security for as long as possible, preventing security firms from developing specific countermeasures against their unique build.
Harvesting Mechanisms: Exfiltrating Sensitive Assets
Once the environment is deemed safe, Agent Tesla deploys over 20 different harvesting modules to steal sensitive information from browsers, messaging apps, and email clients. It can decrypt login credentials from modern browsers and hijack session tokens from platforms like Discord, allowing attackers to bypass two-factor authentication by stealing the active session itself. This is a devastating capability, as it renders one of the most common security layers ineffective. The malware specifically targets cookies and saved passwords, looking for high-value financial targets that can be used for further fraud.
All stolen data is then exfiltrated via hardcoded FTP credentials to a remote server, where the attackers track each compromised host using unique hardware identifiers. This allows them to manage their growing network of victims and prioritize targets based on the quality of the harvested data. By assigning a unique ID to every infected machine, the threat actors can maintain an organized database of compromised corporate accounts. This level of organization suggests a professional operation aimed at long-term financial gain rather than a simple, one-off opportunistic attack against random individuals.
Proactive Defense: Securing the Financial Perimeter
To counter these evolving threats, organizations implemented stricter macro and script execution policies that effectively mitigated the risks posed by JScript droppers. Many security teams moved toward hardware-backed authentication to neutralize the threat of session token hijacking, ensuring that even if a token was stolen, it could not be used on an unauthorized device. Furthermore, advanced endpoint detection and response systems were tuned to monitor for reflective memory injection, providing visibility into the volatile memory spaces where fileless malware typically resides. These technical adjustments were supported by a renewed focus on employee awareness training regarding bank impersonation.
The success of these defensive measures depended on the continuous monitoring of suspicious network traffic, particularly unauthorized FTP connections to unknown domains. Security professionals shifted their focus toward behavioral heuristics, which allowed them to identify the malicious actions of a process even when its identity was masked by forged metadata. By adopting a zero-trust architecture, companies ensured that no single script or file could execute without a verified chain of trust. This proactive approach significantly reduced the window of opportunity for attackers, forcing them to find even more complex and expensive ways to infiltrate well-defended corporate networks.
