Agent Tesla Multi-Stage Phishing Campaign with Process Hollowing of Aspnet_compiler.exe and SMTP Credential Exfiltration
Agent Tesla Multi-Stage Phishing Campaign with Process (TL-2026-0772), also tracked as Agent Tesla PO0172 campaign, is a high-severity malware campaign, first published 2026-06-10. It has no confirmed attribution, affects Microsoft Windows (Windows Script Host / .NET Framework), maps to 24 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0772
- Threat ID
- TL-2026-0772
- Also known as
- Agent Tesla PO0172 campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-10
- Last reviewed
- 2026-06-10
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, logistics, finance, retail
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Agent Tesla Multi-Stage Phishing Campaign with Process
Malware and tooling: Agent Tesla
A phishing-led, multi-stage Agent Tesla campaign documented by FortiGuard Labs delivers a RAR-borne obfuscated JScript (.jse) loader that fetches an AES-encrypted PowerShell payload from files.catbox.moe, decrypts and executes it in memory, hollows the trusted .NET utility Aspnet_compiler.exe to host the Agent Tesla .NET payload, runs virtualization/sandbox anti-analysis checks, then steals browser, email, and FTP credentials and exfiltrates them over SMTP to mail.taikei-rmc-co.biz.
How Agent Tesla Multi-Stage Phishing Campaign with Process works
FortiGuard Labs published an analysis on 25 February 2026 of an active, phishing-led Agent Tesla infostealer campaign that uses a fileless, multi-stage infection chain designed to evade endpoint detection. The chain begins with purchase-order-themed phishing emails (e.g. subject "New Purchase Order PO0172") carrying a RAR archive (PO0172.rar) that contains a heavily obfuscated JScript loader (PO0172.jse). When executed, the JSE loader reaches out to the legitimate file-sharing host files.catbox.moe and downloads an AES-encrypted PowerShell script (hxxps://files.catbox.moe/2x0j75.ps1).
The first-stage PowerShell decrypts the next stage in memory using a custom Invoke-AESDecryption routine implementing AES-CBC with PKCS7 padding. The second-stage PowerShell performs process hollowing against C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe — a trusted, Microsoft-signed .NET compilation utility — creating the process in a suspended state, unmapping its image, writing a .NET loader and the Agent Tesla payload into its address space, and resuming execution so the malicious code runs under the identity of a benign binary. The entire chain (JScript loader, PowerShell stages, .NET loader, and Agent Tesla payload) executes in memory with no malicious PE written to disk, frustrating file-based detection.
Before stealing data, the payload runs anti-analysis and sandbox-evasion checks: it queries WMI for virtualization artifacts (strings such as "VMware", "VirtualBox", "Hyper-V", "Microsoft Corporation") and scans loaded modules for known analysis and security DLLs including snxhk.dll (Avast), SbieDll.dll (Sandboxie), and cmdvrt32.dll (Comodo). If a monitored environment is detected, execution halts.
Agent Tesla (MITRE Software S0331) is a long-running .NET-based infostealer/RAT that harvests credentials and data from a wide range of installed applications — web browsers (Chrome, Firefox, Opera, Edge, Brave), email clients (Outlook, Thunderbird), and FTP/VPN clients (FileZilla) — and captures cookies (with hostnames and expiry dates), saved passwords, contacts, keystrokes, clipboard contents, and screenshots. In this campaign, the stolen data is bundled (often as text files) and exfiltrated over SMTP to the attacker-controlled mail server mail.taikei-rmc-co.biz, a common Agent Tesla exfiltration method that blends with legitimate outbound mail traffic. The campaign carries no CVE; severity is HIGH given active exploitation, credential-theft impact, and concrete published IOCs enabling SOC detection and hunting.
MITRE ATT&CK techniques used in TL-2026-0772
Collection
T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading
Exfiltration
T1048 Exfiltration Over Alternative Protocol
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery; T1518 Software Discovery
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities; T1608 Stage Capabilities
Affected products and versions in Agent Tesla Multi-Stage Phishing Campaign with Process
- Microsoft — Windows (Windows Script Host / .NET Framework)
Vulnerable versions: Windows endpoints with WSH and .NET Framework v4.0.30319 enabled - Google — Chrome (credential/cookie theft target)
Vulnerable versions: all - Mozilla — Firefox / Thunderbird (credential theft target)
Vulnerable versions: all - Microsoft — Outlook (credential theft target)
Vulnerable versions: all
Remediation for Agent Tesla Multi-Stage Phishing Campaign with Process
Immediate actions
- Block the C2 exfiltration domain mail.taikei-rmc-co.biz and the payload host files.catbox.moe at the perimeter, mail gateway, and DNS resolver
- Block the download URL hxxps://files.catbox.moe/2x0j75.ps1 and alert on any access to files.catbox.moe
- Hunt for and quarantine the four published SHA256 hashes across endpoints
- Alert on Aspnet_compiler.exe spawning from non-build contexts or making outbound network connections
Workarounds
- Disable Windows Script Host (wscript.exe/cscript.exe) for standard users
- Block RAR/archive attachments containing script files at the email gateway
- Apply Attack Surface Reduction rules blocking Office/script-spawned child processes
Longer-term hardening
- Deploy EDR with behavioral detection for process hollowing (CreateProcess SUSPENDED + memory unmap/write + ResumeThread) on signed .NET utilities
- Enable PowerShell script-block and module logging plus AMSI to capture in-memory decryption stages
- Restrict execution of .jse/.js/.vbs via Windows Script Host using ASR rules or file-association hardening
- Egress-filter outbound SMTP (TCP 25/465/587) to only sanctioned mail relays to break SMTP exfiltration
Timeline of Agent Tesla Multi-Stage Phishing Campaign with Process
- Agent Tesla .NET-based infostealer/RAT (MITRE S0331) first emerges and is sold as malware-as-a-service, becoming one of the most prevalent commodity infostealers.
- Agent Tesla harvests browser/email/FTP credentials, cookies, and contacts and exfiltrates them over SMTP to the attacker-controlled mail server mail.taikei-rmc-co.biz.
- Payload runs WMI virtualization checks (VMware/VirtualBox/Hyper-V) and scans for analysis DLLs snxhk.dll, SbieDll.dll, and cmdvrt32.dll before proceeding.
- Second-stage PowerShell hollows the trusted .NET utility Aspnet_compiler.exe and injects a .NET loader plus the Agent Tesla payload for in-memory execution.
- JSE loader downloads an AES-encrypted PowerShell payload from files.catbox.moe (hxxps://files.catbox.moe/2x0j75.ps1) and decrypts it in memory via Invoke-AESDecryption (AES-CBC/PKCS7).
- Phishing emails using purchase-order lures (e.g. 'New Purchase Order PO0172') deliver a RAR archive (PO0172.rar) containing an obfuscated JScript loader (PO0172.jse).
- FortiGuard Labs publishes 'Unmasking Agent Tesla: A Deep Dive into a Multi-Stage Campaign' documenting the PO0172 phishing chain, process hollowing of Aspnet_compiler.exe, and SMTP exfiltration.
- Secondary security outlets (CyberSecurityNews, GBHackers, CyberPress, VPNCentral) amplify the FortiGuard findings, recommending blocking of the C2 and payload-host IOCs.
Sources cited for Agent Tesla Multi-Stage Phishing Campaign with Process
- Unmasking Agent Tesla: A Deep Dive into a Multi-Stage Campaign
- Phishing-Led Agent Tesla Campaign Uses Process Hollowing and Anti-Analysis to Evade Detection
- Phishing-Led Agent Tesla Campaign Uses Process Hollowing and Anti-Analysis
- Agent Tesla Phishing Campaign Uses Process Hollowing To Evade Security Tools
- Agent Tesla Phishing Campaign Uses Process Hollowing and Anti-Analysis to Steal Credentials
- Agent Tesla, Software S0331
- Inside the Mind of a 'Rat' - Agent Tesla Detection and Analysis
- Detecting The Agent-Tesla Malware Family
Threats related to Agent Tesla Multi-Stage Phishing Campaign with Process
- Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations
- Pony (Fareit/Siplog) Credential-Stealing Trojan and Downloader
- The TTF Trap: Global Phishing Campaign Delivers Lua-Based Loader for Agent Tesla, Remcos RAT, XWorm
- Remcos RAT Delivered via Steganographic Multi-Stage Loader in 'GST Debit Note' India-Targeted Phishing Campaign
- Multi-Stage Steganographic Loader Campaign Deploying Remcos RAT and Diverse Stealer Payloads (K7 Labs, June 2026)
- Multi-Stage Steganographic Loader Delivers Remcos RAT and Rotating Infostealers via .NET Bitmap Resource Steganography and AppDomain.Load In-Memory Execution
Detection coverage for TL-2026-0772
As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0772 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.