# Agent Tesla Multi-Stage Phishing Campaign with Process Hollowing of Aspnet_compiler.exe and SMTP Credential Exfiltration

> A phishing-led, multi-stage Agent Tesla campaign documented by FortiGuard Labs delivers a RAR-borne obfuscated JScript (.jse) loader that fetches an AES-encrypted PowerShell payload from files.catbox.moe, decrypts and executes it in memory, hollows the trusted .NET utility Aspnet_compiler.exe to host the Agent Tesla .NET payload, runs virtualization/sandbox anti-analysis checks, then steals browser, email, and FTP credentials and exfiltrates them over SMTP to mail.taikei-rmc-co.biz.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0772
- **ID:** TL-2026-0772
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FortiGuard Labs published an analysis on 25 February 2026 of an active, phishing-led Agent Tesla infostealer campaign that uses a fileless, multi-stage infection chain designed to evade endpoint detection. The chain begins with purchase-order-themed phishing emails (e.g. subject "New Purchase Order PO0172") carrying a RAR archive (PO0172.rar) that contains a heavily obfuscated JScript loader (PO0172.jse). When executed, the JSE loader reaches out to the legitimate file-sharing host files.catbox.moe and downloads an AES-encrypted PowerShell script (hxxps://files.catbox.moe/2x0j75.ps1).

The first-stage PowerShell decrypts the next stage in memory using a custom Invoke-AESDecryption routine implementing AES-CBC with PKCS7 padding. The second-stage PowerShell performs process hollowing against C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe — a trusted, Microsoft-signed .NET compilation utility — creating the process in a suspended state, unmapping its image, writing a .NET loader and the Agent Tesla payload into its address space, and resuming execution so the malicious code runs under the identity of a benign binary. The entire chain (JScript loader, PowerShell stages, .NET loader, and Agent Tesla payload) executes in memory with no malicious PE written to disk, frustrating file-based detection.

Before stealing data, the payload runs anti-analysis and sandbox-evasion checks: it queries WMI for virtualization artifacts (strings such as "VMware", "VirtualBox", "Hyper-V", "Microsoft Corporation") and scans loaded modules for known analysis and security DLLs including snxhk.dll (Avast), SbieDll.dll (Sandboxie), and cmdvrt32.dll (Comodo). If a monitored environment is detected, execution halts.

Agent Tesla (MITRE Software S0331) is a long-running .NET-based infostealer/RAT that harvests credentials and data from a wide range of installed applications — web browsers (Chrome, Firefox, Opera, Edge, Brave), email clients (Outlook, Thunderbird), and FTP/VPN clients (FileZilla) — and captures cookies (with hostnames and expiry dates), saved passwords, contacts, keystrokes, clipboard contents, and screenshots. In this campaign, the stolen data is bundled (often as text files) and exfiltrated over SMTP to the attacker-controlled mail server mail.taikei-rmc-co.biz, a common Agent Tesla exfiltration method that blends with legitimate outbound mail traffic. The campaign carries no CVE; severity is HIGH given active exploitation, credential-theft impact, and concrete published IOCs enabling SOC detection and hunting.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1588 Obtain Capabilities
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1113 Screen Capture
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [Unmasking Agent Tesla: A Deep Dive into a Multi-Stage Campaign](https://www.fortinet.com/blog/threat-research/unmasking-agent-tesla-deep-dive-into-multi-stage-campaign)
- [Phishing-Led Agent Tesla Campaign Uses Process Hollowing and Anti-Analysis to Evade Detection](https://cybersecuritynews.com/phishing-led-agent-tesla-campaign/)
- [Phishing-Led Agent Tesla Campaign Uses Process Hollowing and Anti-Analysis](https://gbhackers.com/phishing-led-agent-tesla/)
- [Agent Tesla Phishing Campaign Uses Process Hollowing To Evade Security Tools](https://cyberpress.org/agent-tesla-evades-detection/)
- [Agent Tesla Phishing Campaign Uses Process Hollowing and Anti-Analysis to Steal Credentials](https://vpncentral.com/agent-tesla-phishing-campaign-uses-process-hollowing-and-anti-analysis-to-steal-credentials/)
- [Agent Tesla, Software S0331](https://attack.mitre.org/software/S0331/)
- [Inside the Mind of a 'Rat' - Agent Tesla Detection and Analysis](https://www.splunk.com/en_us/blog/security/inside-the-mind-of-a-rat-agent-tesla-detection-and-analysis.html)
- [Detecting The Agent-Tesla Malware Family](https://corelight.com/blog/detecting-agent-tesla-malware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0772