A fresh release of the Agent Tesla malware now deploys Unicode emoji characters to dodge detection while stealing login credentials from more than 40 applications, according to research published August 20 by KnowBe4. The cybersecurity company examined Agent Tesla version 4, an information-stealing program delivered through a business email compromise scam aimed at finance teams. The attack marks a shift in how malware authors mask malicious code from security tools and human review.

The campaign reached targets through a forwarded email thread designed to mimic internal workplace communication, with attackers impersonating Metropolitan Bank and Trust Company, a legitimate bank based in the Philippines. The fake message instructed recipients to verify an attached document and send a reply. Once opened, a JScript dropper launches the malware, with hearts, water droplets, and other emoji symbols woven throughout the script's code body. This tactic breaks up string-based signature matching and creates enough visual clutter to slip past casual inspection. After execution, the dropper writes two files to a public libraries folder, one serving as misdirection while the other triggers DonutLoader shellcode for reflective portable executable injection—meaning the final Agent Tesla binary never lands on the filesystem where file-based scanners could catch it. The malware scrambles itself using an obfuscator tool called ConfuserEx, presents as a Python installer in its metadata, and checks immediately for debugger activity to halt if someone attempts analysis. Before harvesting any credentials, it generates a persistent hardware fingerprint that lets attackers track individual victims even after operating system reinstalls or IP address changes.

The researchers noted that the emoji-obfuscation method in the JScript dropper fails against any YARA rule that searches for the Unicode code points used in combination with JScript-specific patterns. "A rule matching both the emoji distribution pattern and WScript.Shell or CreateObject calls will catch this family," the report stated. Agent Tesla version 4 includes multiple defense evasion features, and it disables validation for all outgoing connections to maintain uninterrupted communication with command-and-control infrastructure without triggering security alerts or errors. The malware sweeps credentials from web browsers, messaging platforms, and native Windows credential stores, while also capturing keystrokes and clipboard contents. Every stolen file carries a system fingerprint header containing timestamp, username, computer name, operating system name, CPU, RAM, public IP address, and the MD5 hardware ID, with the credential dump arriving at the attacker's FTP server within seconds of execution and no delayed staging.

The report explains that the malware's reflective injection technique and obfuscation layers allow it to evade traditional file-based detection methods, which rely on scanning static binaries stored on disk. By operating entirely in memory and wrapping itself in ConfuserEx scrambling, Agent Tesla version 4 complicates both automated analysis and manual reverse engineering. The hardware fingerprinting mechanism serves a dual purpose: it prevents duplicate data collection from the same machine and enables attackers to correlate stolen credentials across multiple breaches even when victims change network identifiers or reinstall systems. KnowBe4 advised security teams to update their email security rules to intercept Agent Tesla before it can harvest credentials, emphasizing that detection must shift upstream to catch the dropper at the email gateway rather than waiting for endpoint detection after execution. Organizations with standard signature-based defenses remain vulnerable unless they deploy YARA rules targeting both the Unicode character distribution pattern and JScript-specific API calls like WScript.Shell or CreateObject. The immediate exfiltration speed—seconds rather than minutes or hours—compresses the window for incident response, making prevention the only realistic defense for most targets. Finance departments remain particularly exposed given the campaign's focus on business email compromise lures that exploit routine document review workflows. The shift toward emoji-based obfuscation signals a broader trend in which malware authors exploit visual noise and Unicode complexity to defeat both automated tools and human analysts, forcing defenders to retool detection logic for character-level patterns rather than semantic content alone.