Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated JScript Evades Detection in BEC Campaign Targeting Finance Teams
Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated (TL-2026-2108), also tracked as SWIFT Payment Maker Campaign, is a high-severity malware campaign, first published 2026-08-22. It has no confirmed attribution, affects Microsoft Windows Script Host / Outlook, maps to 17 MITRE ATT&CK techniques (T1027.002, T1056.001, T1059.007), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-2108
- Threat ID
- TL-2026-2108
- Also known as
- SWIFT Payment Maker Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-22
- Last reviewed
- 2026-08-22
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, banking
- Target regions
- philippines, Global
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated
Malware and tooling: Agent Tesla, Agent Tesla v4, DonutLoader, ConfuserEx
An active Agent Tesla v4 business email compromise campaign impersonates Metropolitan Bank and Trust Company (Philippines) to deliver a 6.94 MB JScript attachment whose code body is saturated with Unicode emoji characters that Windows Script Host silently ignores, defeating string-signature detection. The dropper stages DonutLoader shellcode that reflectively injects a ConfuserEx-obfuscated, Python-metadata-spoofed .NET 4.0 Agent Tesla payload directly into memory, which then harvests credentials from 27 Chromium and 13 Mozilla browsers, Outlook, Foxmail, Thunderbird, Discord, and Windows Credential Manager before exfiltrating over FTP.
How Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated works
KnowBe4 Threat Labs documented an in-the-wild Agent Tesla v4 campaign that pairs a convincing wire-transfer BEC lure with a fileless, multi-stage execution chain. The initial vector is a forwarded-thread phishing email spoofing Metropolitan Bank and Trust Company, a Philippine bank, urging the recipient to confirm an attached 'SWIFT Payment Maker 103 - 10.06.26.JS' file (SHA-256 615f9ecc51ccce0de6e88dcff70662f77965214bf5ad0cc7e07bc4fae72c40d0, 6.94 MB).
The attachment is a JScript dropper whose entire obfuscation layer consists of Unicode emoji characters (hearts, water droplets) interleaved throughout the functional code. Windows Script Host's JScript interpreter parses past these characters as noise while executing the underlying logic untouched, defeating casual analyst review and string-based signature matching. On execution, the dropper writes two files to C:\Users\Public\Libraries\: wabmmxofrrdsjlsx.exe, a 32-bit .NET loader, and wabmmxofrrdsjlsx.ttf, an encoded Agent Tesla payload blob disguised as a font file. The loader reads the .ttf as raw bytes and passes them to DonutLoader shellcode, which performs reflective PE injection so the final Agent Tesla binary never touches disk.
Before harvesting begins, the payload runs a five-stage anti-analysis gauntlet: GetModuleHandle checks for SbieDll.dll (Sandboxie), snxhk.dll (Avast sandbox hook), cmdvrt32.dll (Comodo Containment), SxIn.dll (360 Total Security), and Sf2.dll (AVG/Avast); CheckRemoteDebuggerPresent debugger detection; Thread.Sleep-based VM timing checks; WMI queries against Win32_ComputerSystem for VirtualBox/VMware manufacturer strings; and a hosting-provider lookup against the legitimate ip-api.com service to detect cloud/VPS sandboxes. The payload itself is a ConfuserEx-obfuscated .NET 4.0 binary whose assembly metadata falsely declares AssemblyProduct 'Python 3.11.3 (64-bit)' and AssemblyCompany 'Python Software Foundation' despite being a 32-bit x86 .NET executable.
Once environment checks pass, Agent Tesla v4 immediately runs 21+ credential-harvesting modules covering 27 Chromium-based browsers (including Chrome, Edge, Brave, Opera, Vivaldi, Yandex) and 13 Mozilla-based browsers (Firefox, Thunderbird, SeaMonkey, Waterfox, Pale Moon), decrypting Chrome 80+ credential stores via Local State master-key retrieval and AES-GCM decryption of v10/v11 blobs, and falling back to CryptUnprotectData for legacy Chrome. It also pulls Outlook (versions 11.0-16.0) credentials from the registry, Foxmail passwords, Thunderbird contacts, Windows Credential Manager/Vault entries, and Discord LevelDB-stored OAuth2 session tokens for account takeover. Keylogging and clipboard capture run continuously; a screen-capture module is present but was disabled in the analyzed sample. The malware also derives a hardware fingerprint from WMI-sourced motherboard serial, processor ID, and MAC address to let the operator track individual victims.
For persistence, the malware copies itself to %APPDATA%\eCXCES\eCXCES.exe and registers HKCU\Software\Microsoft\Windows\CurrentVersion\Run\eCXCES. Stolen credentials, keylogs, screenshots, and contact lists are exfiltrated within seconds of collection via .NET FtpWebRequest STOR commands to a single hardcoded FTP server, ftp.melrz.com (162.0.209.89, TCP ports 21 and 12038), authenticating with embedded credentials info@melrz.com / Newmoney2023.. File naming follows a fixed convention: PW_{user}/{host}_{datetime}.html for credentials, KL_ for keylogs, SC_ for screenshots, and Contacts_ for harvested contact lists.
MITRE ATT&CK techniques used in TL-2026-2108
Defense Evasion
T1027.002 Obfuscated Files or Information: Software Packing; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1620 Reflective Code Loading; T1622 Debugger Evasion
Credential Access
T1056.001 Input Capture: Keylogging; T1539 Steal Web Session Cookie; T1552.002 Unsecured Credentials: Credentials in Registry; T1555.003 Credentials from Password Stores: Credentials from Web Browsers; T1555.004 Credentials from Password Stores: Windows Credential Manager
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File
Command and Control
T1071.002 Application Layer Protocol: File Transfer Protocols
Discovery
T1082 System Information Discovery; T1518.001 Software Discovery: Security Software Discovery
Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Initial Access
Affected products and versions in Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated
- Microsoft — Windows Script Host / Outlook
Vulnerable versions: Windows Script Host on all currently supported Windows versions; Outlook 2003-2019 (Office 11.0-16.0) - Multiple — Chromium-based browsers (27 variants including Chrome, Edge, Brave, Opera, Vivaldi, Yandex)
Vulnerable versions: Chrome 80+ Local State/DPAPI credential store format; legacy Chrome CryptUnprotectData-protected stores - Multiple — Mozilla-based browsers (13 variants including Firefox, Thunderbird, SeaMonkey, Waterfox, Pale Moon)
Vulnerable versions: all versions storing profile-based saved logins
Remediation for Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated
Immediate actions
- Block outbound FTP (TCP 21, 12038) to ftp.melrz.com and 162.0.209.89 at the perimeter/DNS layer.
- Quarantine/block inbound emails carrying .JS/.JSE attachments, especially wire-transfer or SWIFT-payment themed lures impersonating banks.
- Hunt for C:\Users\Public\Libraries\wabmmxofrrdsjlsx.exe / .ttf and %APPDATA%\eCXCES\eCXCES.exe across finance-team endpoints.
- Force-reset credentials for any account whose browser, Outlook, Discord, or Windows Credential Manager store may have been harvested.
Workarounds
- Restrict WScript.exe/CScript.exe execution for standard users via AppLocker/WDAC.
- Block execution of files from C:\Users\Public\Libraries\ via software restriction policy.
Longer-term hardening
- Disable Windows Script Host (WSH) execution of .js/.jse/.vbs email attachments via GPO or ASR rules.
- Deploy EDR/behavioral detection for reflective PE injection and shellcode-loader (Donut-style) patterns rather than relying on file-based AV signatures.
- Enable script-block logging and monitor for high-density non-ASCII/emoji character ratios in JScript/VBScript execution as a detection heuristic.
- Require out-of-band verification for any wire-transfer/SWIFT payment confirmation email before action.
Timeline of Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated
- Agent Tesla is first documented as a commodity .NET-based keylogger and information-stealer sold as malware-as-a-service; it later evolves into the v4 lineage used in this campaign.
- KnowBe4 Threat Labs publishes 'Anatomy of an Agent Tesla BEC Attack: From Inbox to In-Memory Infostealer,' the primary technical analysis of the campaign.
- Stolen credentials, keylogs, screenshots, and contacts are uploaded within seconds via FtpWebRequest STOR commands to ftp.melrz.com (162.0.209.89), authenticating with the hardcoded info@melrz.com FTP account.
- The malware copies itself to %APPDATA%\eCXCES\eCXCES.exe and registers the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\eCXCES autorun key to survive reboot.
- Agent Tesla v4 immediately harvests stored credentials from 27 Chromium and 13 Mozilla browsers, Outlook, Foxmail, Thunderbird, Discord tokens, and Windows Credential Manager, alongside keylogging and clipboard capture.
- DonutLoader shellcode decodes the wabmmxofrrdsjlsx.ttf blob and reflectively injects the ConfuserEx-obfuscated, Python-metadata-spoofed .NET 4.0 Agent Tesla v4 payload directly into memory, so the final binary never touches disk.
- The dropped loader runs a five-stage sandbox/AV detection gauntlet (SbieDll.dll, snxhk.dll, cmdvrt32.dll, SxIn.dll, Sf2.dll module checks), CheckRemoteDebuggerPresent, VM timing checks, WMI hardware queries, and an ip-api.com hosting-provider lookup before proceeding.
- Windows Script Host executes the Unicode-emoji-obfuscated JScript dropper (SHA-256 615f9ecc51ccce0de6e88dcff70662f77965214bf5ad0cc7e07bc4fae72c40d0), which writes wabmmxofrrdsjlsx.exe and wabmmxofrrdsjlsx.ttf to C:\Users\Public\Libraries\.
- KnowBe4 researchers observe a BEC email spoofing Metropolitan Bank and Trust Company (Philippines) delivering a 6.94 MB JScript attachment, 'SWIFT Payment Maker 103 - 10.06.26.JS', to finance-team targets.
- Cyber Security News, GBHackers, and Infosecurity Magazine independently report on the KnowBe4 findings, broadening awareness of the Unicode-emoji JScript evasion technique.
Sources cited for Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated
- Hackers Hide Agent Tesla JScript Behind Unicode Emojis to Evade Detection
- Hackers Hide Agent Tesla Malware Behind Emojis to Steal Browser and Email Passwords
- Anatomy of an Agent Tesla BEC Attack: From Inbox to In-Memory Infostealer
- New Agent Tesla Malware Variant Boosts Evasion Capabilities
- New Agent Tesla malware version uses emoji obfuscation to evade detection
- Agent Tesla v4 Uses BEC Lures and In-Memory Injection to Evade Detection
Threats related to Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated
Detection coverage for TL-2026-2108
As of 2026-08-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2108 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2108
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.