Threat reportMalwareTL-2026-3484
AgentTesla Infostealer Distributed via Business Proposal Phishing Emails (Fake Café Management Software)
AgentTesla Infostealer Distributed via Business Proposal (TL-2026-3484), also tracked as Agent Tesla, is a medium-severity malware campaign, first published 2026-10-14. It has no confirmed attribution, affects Microsoft Windows (.NET-capable endpoints), maps to 11 MITRE ATT&CK techniques (T1005, T1027.003, T1036.005), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3484
- Threat ID
- TL-2026-3484
- Also known as
- Agent Tesla, AgentTesla
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, food-service, small-business
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in AgentTesla Infostealer Distributed via Business Proposal
Malware and tooling: Agent Tesla
How AgentTesla Infostealer Distributed via Business Proposal works
AhnLab ASEC reports an active phishing campaign using business-proposal emails with a ZIP attachment containing an executable disguised as café management software. A three-stage .NET loader hides payloads in bitmap resources and deploys AgentTesla, which steals credentials, cookies and contact data from browsers, email clients, FTP programs and VPN programs and exfiltrates over FTP.
ASEC (AhnLab Security Intelligence Center) documented an AgentTesla distribution case disguised as a business proposal email. The lure asks the recipient to review an attached product list and reply with feedback on inventory and pricing. The attachment is a ZIP named in the pattern '{Company Name} LIST.ZIP' containing an executable. The executable's assembly description is Chinese-language text describing a program for café operations, menus, orders and ingredient management, so it poses as café management software.
The executable uses a multi-stage loading chain. Stage 1 (the café loader) reads RGB pixel values from a bitmap resource named Resources.Fee, reconstructs a .NET DLL from them and loads it with Assembly.Load. Stage 2 is a DLL labeled as Kingsoft security software; it reads a 471x471-pixel bitmap named HATA and decrypts the data with an XOR key 'yjw'. Stage 3 is disguised as Microsoft PC Manager; it copies the original file to %APPDATA%\AH.Exe and decrypts an embedded resource named 8VXmw2w using the UTF-8 key 'ZIyStAzSE', yielding the AgentTesla payload.
AgentTesla collects credentials, cookies and contact information from web browsers, email clients, FTP programs and VPN programs. It also queries the victim's public IP address and detects hosting-server environments. Stolen data is exfiltrated over FTP to server356.Web-hosting.Com using an attacker-controlled FTP account (credentials appear in the ASEC report and are intentionally not reproduced here). The ASEC report states no CVE, CVSS score or threat-actor attribution. A BeaconBeagle domain-config search for server356.web-hosting.com returned no matches.
MITRE ATT&CK techniques used in TL-2026-3484
Collection
Defense Evasion
T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Execution
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Initial Access
Affected products and versions in AgentTesla Infostealer Distributed via Business Proposal
- Microsoft — Windows (.NET-capable endpoints)
Vulnerable versions: Hosts executing the malicious attachment
Remediation for AgentTesla Infostealer Distributed via Business Proposal
Immediate actions
- Block and quarantine ZIP attachments matching the '{Company Name} LIST.ZIP' pattern that contain executables
- Block outbound FTP to server356.Web-hosting.Com and alert on any FTP egress from user workstations
- Hunt for %APPDATA%\AH.Exe and the listed MD5 hashes; isolate affected hosts
- Reset credentials, revoke browser sessions/cookies and rotate VPN and FTP credentials stored on affected hosts
Workarounds
- Train users to treat unsolicited business-proposal emails with ZIP/EXE attachments as suspicious
Longer-term hardening
- Block executable content inside email archives at the mail gateway
- Deploy EDR with detection of in-memory .NET Assembly.Load of image-derived payloads
- Restrict outbound FTP from endpoints to approved destinations
- Enforce MFA and avoid storing credentials in browsers, email clients and FTP clients
Timeline of AgentTesla Infostealer Distributed via Business Proposal
- Per MITRE ATT&CK S0331: Agent Tesla, a .NET spyware/infostealer, first observed at least as early as 2014 (month/day not stated; year-start used as placeholder)
- Agent Tesla entry (S0331) created in MITRE ATT&CK, documenting browser/FTP credential theft, keylogging and HTTP/SMTP C2
- Triage sandbox report of an AgentTesla sample with FTP exfiltration configuration submitted, showing the FTP-exfil pattern predates this campaign
- Per ASEC: AgentTesla harvests browser, email, FTP and VPN credentials, cookies and contacts and exfiltrates via FTP to server356.Web-hosting.Com
- Per ASEC: Kingsoft-labeled DLL XOR-decrypts the 471x471 HATA bitmap (key 'yjw'); PC Manager-labeled stage copies itself to %APPDATA%\AH.Exe and decrypts resource 8VXmw2w (key 'ZIyStAzSE') to AgentTesla
- Per ASEC: café loader extracts RGB pixel values from the Resources.Fee bitmap and loads a .NET DLL via Assembly.Load
- Per ASEC: emails request review of an attached product list; the '{Company Name} LIST.ZIP' attachment contains an executable disguised as café management software
- AhnLab ASEC publishes analysis of AgentTesla distributed via business-proposal phishing emails
Sources cited for AgentTesla Infostealer Distributed via Business Proposal
- Case of AgentTesla Malware Distribution Disguised as a Business Proposal Email (AhnLab ASEC)
- MITRE ATT&CK - Agent Tesla (S0331)
- ManageEngine - Agent Tesla malware profile
- Zscaler - Agent Tesla keylogger delivered using cybersquatting
- Triage sandbox report - AgentTesla sample (FTP exfiltration config)
- BeaconBeagle domain config search - server356.web-hosting.com (no matches)
Detection coverage for TL-2026-3484
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3484 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.