Threat reportMalwareTL-2026-3793
Agent Tesla RAT: credential, keystroke and clipboard theft with Telegram exfiltration
Agent Tesla RAT (TL-2026-3793), also tracked as AgentTesla, is a medium-severity malware campaign, first published 2026-10-17. It has no confirmed attribution, affects Microsoft Windows, maps to 17 MITRE ATT&CK techniques (T1027, T1048.003, T1053.005), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-3793
- Threat ID
- TL-2026-3793
- Also known as
- AgentTesla
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, manufacturing, education, technology
- Target regions
- Global, North America, Europe, Asia, Latin America
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Agent Tesla RAT
Malware and tooling: Agent Tesla, OriginBot, QuirkyLoader, RedLine Clipper
How Agent Tesla RAT works
Agent Tesla is a .NET spyware/RAT sold as malware-as-a-service since at least 2014 that steals keystrokes, clipboard content, screenshots, browser credentials and email passwords. It is delivered mainly by phishing, often through multi-stage loaders, and exfiltrates over SMTP, FTP, HTTP or Telegram.
Agent Tesla (MITRE ATT&CK S0331) is a .NET-based spyware Trojan and remote access tool that has been sold as a commodity malware-as-a-service product since at least 2014. MITRE links its use to the SilverTerrier business-email-compromise cluster (G0083) and the phishing group TA2541 (G1018). Deep Instinct's DIANNA analysis (July 2025) describes a variant that records keystrokes, clipboard contents, browser credentials and email passwords, performs file operations and exfiltration, interacts with the Windows registry, creates temporary files, launches programs and modifies ACLs. It uses Telegram as its data-exfiltration channel. The variant shows anti-analysis behavior: execution-timing checks, identification of security tools, packed or encoded code with abnormal text-section entropy, and mimicry of legitimate activity during reconnaissance. Its strings suggest fake dialogs and prompts for social engineering. Deep Instinct reports its DSX Brain detected the sample one day before VirusTotal submission, while most vendors did not flag it until 2-3 days after upload.
Delivery is typically phishing. A March 2024 Trustwave SpiderLabs campaign used a Polish bank-payment lure with a .tar.gz archive attachment and a .NET loader that patches AmsiScanBuffer before decoding an XOR-encoded Agent Tesla payload in memory; it exfiltrated by SMTP through a compromised Turkish company mailbox. In September 2023 Fortinet documented a Word-document campaign that delivered Agent Tesla (SMTP C2) alongside OriginBotnet and RedLine Clipper through a .NET loader padded to about 400 MB to evade scanning. Since November 2024 IBM X-Force has observed the QuirkyLoader loader delivering Agent Tesla and other families: an archive holding a legitimate executable, an encrypted payload and a malicious DLL is side-loaded, and the payload is injected by process hollowing into AddInProcess32.exe, InstallUtil.exe or aspnet_wp.exe.
An ANY.RUN sandbox run (10 May 2025) of a Telegram-exfiltrating sample shows the typical host footprint: execution from %TEMP%, a copy dropped under %APPDATA%\Roaming, persistence through a scheduled task created from an XML temp file, an external-IP lookup via api.ipify.org, credential theft from browsers, keylogging and screenshots, and exfiltration to api.telegram.org via a bot. MITRE additionally documents process hollowing, Regsvcs/Regasm proxy execution, registry Run keys, credential theft from files and the registry, Wi-Fi profile discovery and webcam capture. Note: the DIANNA article itself provides no IOCs, versions, attribution or ATT&CK mapping; IOCs here come from the cited third-party sandbox and vendor reporting.
MITRE ATT&CK techniques used in TL-2026-3793
Defense Evasion
T1027 Obfuscated Files or Information; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574.001 DLL
Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1567 Exfiltration Over Web Service
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1056.001 Keylogging; T1555.003 Credentials from Web Browsers
Command and Control
Discovery
T1082 System Information Discovery
Collection
Execution
Initial Access
T1566.001 Spearphishing Attachment
defense-impairment
Affected products and versions in Agent Tesla RAT
- Microsoft — Windows
Vulnerable versions: Windows endpoints running the .NET Framework
Remediation for Agent Tesla RAT
Immediate actions
- Block or alert on non-browser processes connecting to api.telegram.org and api.ipify.org
- Quarantine and reimage hosts showing Agent Tesla persistence (scheduled tasks pointing to randomly named executables in %APPDATA%\Roaming)
- Reset browser-saved, email and FTP credentials on affected hosts and revoke active sessions
- Quarantine inbound archive attachments (.tar.gz, .zip, .rar) and Office documents containing embedded images or macros pending sandbox detonation
Workarounds
- Restrict outbound SMTP, FTP and Telegram API access to approved hosts and applications
- Use application control to block unsigned executables launched from user-writable paths
Longer-term hardening
- Deploy EDR with behavioral coverage for process hollowing into AddInProcess32.exe, InstallUtil.exe, aspnet_wp.exe and RegAsm/RegSvcs
- Enforce AMSI and script/.NET logging and alert on AmsiScanBuffer tampering
- Disable browser password storage in favor of an enterprise password manager with MFA
- Run phishing-awareness training for payment-notification and document-sharing lures
Timeline of Agent Tesla RAT
- Agent Tesla has been sold as malware-as-a-service since at least 2014 (year-level date; exact day not stated in sources)
- Fortinet FortiGuard Labs reports a Word-document phishing campaign delivering Agent Tesla, OriginBotnet and RedLine Clipper through a .NET loader padded to about 400 MB
- Trustwave SpiderLabs identifies a Polish bank-payment phishing campaign using a .tar.gz attachment and an AMSI-patching .NET loader to deliver Agent Tesla, exfiltrating via SMTP through a compromised Turkish mailbox (reported by The Hacker News on 2024-03-27)
- IBM X-Force begins observing QuirkyLoader delivering Agent Tesla and other RATs and infostealers via DLL side-loading and process hollowing (month-level date)
- ANY.RUN sandbox analysis of an Agent Tesla sample (original filename BnnU.exe) confirms scheduled-task persistence, api.ipify.org lookup and Telegram bot exfiltration
- IBM X-Force observes two QuirkyLoader campaigns in July 2025 targeting Taiwan and Mexico (month-level date)
- Deep Instinct publishes DIANNA analysis of an Agent Tesla variant exfiltrating over Telegram; its DSX Brain detected the sample one day before VirusTotal submission, with most vendors flagging it 2-3 days after upload
Sources cited for Agent Tesla RAT
- DIANNA Explains 2: Agent Tesla - A Better RAT
- MITRE ATT&CK: Agent Tesla (S0331)
- ANY.RUN sandbox report: Agent Tesla with Telegram C2
- The Hacker News: New Phishing Attack Delivers Agent Tesla via Fresh Loader (Trustwave SpiderLabs)
- The Hacker News: Sophisticated Phishing Campaign Delivers Agent Tesla, OriginBotnet and RedLine Clipper (Fortinet)
- IBM X-Force Threat Analysis: QuirkyLoader - A new malware loader delivering infostealers and RATs
- The Hacker News: Hackers Using New QuirkyLoader Malware
- WeLiveSecurity: Agent Tesla - principales caracteristicas de este malware
Detection coverage for TL-2026-3793
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3793 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3793
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.