Kiran 
A business email compromise campaign spoofing a real Philippine bank, Metropolitan Bank and Trust Company, is delivering a heavily evolved strain of Agent Tesla malware, and the attackers have found a strange new way to slip past defenses: burying malicious JScript logic inside walls of Unicode emoji characters.
Researchers at KnowBe4 Threat Lab, led by analysts Prabhakaran Ravichandhiran and Jeewan Singh Jalal, dissected the full attack chain, revealing an infostealer built for stealth, persistence, and near-total credential harvesting across dozens of applications.
The campaign begins with a phishing email that appears to be a forwarded internal thread involving a Relationship Associate at the spoofed bank.
Agent Tesla BEC Attack Hides Malware in Emoji
It references specific wire transactions and company names, then pressures the recipient with urgency: “KINDLY CONFIRM BELOW ATTACHED AND GET BACK TO US ASAP.” This blend of borrowed institutional trust and manufactured time pressure is classic social engineering, tuned specifically to finance department staff who routinely handle wire approvals.
The attached file, a 6.94 MB JScript dropper named to resemble a SWIFT payment document, hides its real logic behind interleaved Unicode emoji hearts, water droplets, and similar symbols scattered through the code.
Windows Script Host’s JScript interpreter ignores these characters at parse time, but they’re enough to defeat string-based signature matching and confuse anyone doing a casual manual review.
There’s no base64-decode-and-execute step and no secondary download; the dropper writes two files directly to a public libraries folder: a loader executable and a file disguised as a .ttf file that actually contains the encoded payload.
That payload never touches disk as a standalone executable. Instead, the loader feeds it through DonutLoader shellcode for reflective in-memory injection, landing a ConfuserEx-obfuscated .NET binary directly into memory.
“What’s notable here isn’t the malware family itself. Agent Tesla has been a workhorse of commodity crimeware for a decade; it’s the operational discipline.
Emoji obfuscation is trivial to implement but genuinely disrupts automated triage, and pairing it with fileless injection means a lot of endpoint tooling is looking in the wrong place entirely,” said a KnowBe4 threat analyst familiar with the research.
Before harvesting anything, the payload runs anti-analysis checks: a debugger detection call, a live IP lookup against hosting provider databases, and a VM timing attack using Thread.Sleep, sandbox DLL enumeration (targeting Sandboxie, Avast, Comodo, and 360 Total Security artifacts), and WMI queries hunting for VMware or VirtualBox signatures. Any positive hit and the process silently exits.
Once cleared, 21 modules sweep credentials from 27 Chromium- and 13 Mozilla-based browsers, Outlook, Foxmail, Discord (including MFA session tokens), Thunderbird contacts, and Windows Credential Manager via direct calls to vaultcli.dll. A custom SQLite parser and handle-duplication tricks let it read files locked by active browser processes.
Keylogging and clipboard-capture modules are fully built into this sample but remain disabled, infrastructure-ready to be flipped on in future builds.
Everything credentials, keylogs, screenshots, contacts funnels to one FTP domain, ftp[.]melrz[.]com, with plaintext credentials embedded directly in the binary. Each file carries a hardware fingerprint hashed with MD5, allowing operators to track victims across reinstalls.
The takeaway for defenders: signature-based email filtering and disk-based AV scanning both miss steps in this chain. Behavioral detection around script-to-shellcode-to-memory-injection patterns, plus user training against urgency-driven wire-transfer lures, remain the more durable countermeasures.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
