Microsoft Q3 2026 Email Threat Landscape: Device Code Phishing via QR Salary-Review Lures and Agent Tesla RAR Campaign

Key facts for Agent Tesla RAR campaign

Detection coverage for Agent Tesla RAR campaign

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5331 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Agent Tesla Lure — Double-Extension Script Dropper and Misleading RAR Archive Execution (TL-2026-5331)

Detects wscript/cscript launching a JavaScript file hidden behind a document double extension (e.g. 'Nuevo orden de compra – 21092026.pdf.js'), WinRAR/7-Zip opening misleading-extension RAR archives (.pdf.uu, .xml.001), and process command lines referencing the campaign lure names (Nomina 21.09.2026, Nuevo orden de compra, Your-Q3-Compensation-Summary). Covers the September 21 2026 Spanish-language Agent Tesla campaign delivery-to-execution step (user opens the archive and runs the extracted .pdf.js).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.001, T1204.002, T1059.007
• Data sources: sysmon:EventCode=1, index=sysmon, DeviceProcessEvents, windows_process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval ofn=lower(OriginalFileName), cmd=lower(CommandLine), parent=lower(ParentImage)
| eval wsh_double_ext=if(match(ofn,"^(wscript|cscript)[.]exe$") AND match(cmd,"[.](pdf|xml|docx?|xlsx?|jpg|png|txt)[.](js|jse|wsf|vbs)"),1,0)
| eval archive_lure=if(match(cmd,"[.](pdf|xml)[.](uu|001)") AND match(parent,"winrar|7zfm|7zg|explorer"),1,0)
| eval lure_name=if(match(cmd,"nuevo orden de compra|nomina 21[.]09[.]2026|your-q3-compensation-summary"),1,0)
| where wsh_double_ext=1 OR archive_lure=1 OR lure_name=1
| table _time host User Image CommandLine ParentImage ParentCommandLine Hashes wsh_double_ext archive_lure lure_name

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("wscript.exe", "cscript.exe") and ProcessCommandLine matches regex @"(?i)[.](pdf|xml|docx?|xlsx?|jpg|png|txt)[.](js|jse|wsf|vbs)")
    or (FileName in~ ("winrar.exe", "7zfm.exe", "7zg.exe") and ProcessCommandLine matches regex @"(?i)[.](pdf|xml)[.](uu|001)")
    or ProcessCommandLine matches regex @"(?i)nuevo orden de compra|nomina 21[.]09[.]2026|your-q3-compensation-summary"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Double-Extension Script Dropper or Lure Archive Execution (TL-2026-5331)
id: 3b9a6e52-71c4-4d08-9f1a-5c2e8d7b4a10
status: experimental
description: Detects wscript/cscript launching a script hidden behind a document double extension (.pdf.js) and WinRAR/7-Zip opening misleading-extension RAR archives (.pdf.uu, .xml.001) used in the September 2026 Agent Tesla campaign.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/11/05/email-threat-landscape-q3-2026-trends-and-insights/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.t1059.007
  - attack.s0331
logsource:
  category: process_creation
  product: windows
detection:
  selection_wsh:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|re: '(?i)[.](pdf|xml|docx?|xlsx?|jpg|png|txt)[.](js|jse|wsf|vbs)'
  selection_archive:
    Image|endswith:
      - '\winrar.exe'
      - '\7zfm.exe'
      - '\7zg.exe'
    CommandLine|re: '(?i)[.](pdf|xml)[.](uu|001)'
  selection_lure:
    CommandLine|contains:
      - 'Nuevo orden de compra'
      - 'Nomina 21.09.2026'
      - 'Your-Q3-Compensation-Summary'
  condition: 1 of selection_*
falsepositives:
  - Legitimate admin scripts that use double extensions
  - Genuine split archives named *.001 opened with 7-Zip
level: high

Known false positives:

• Legitimate administrative scripts deliberately named with a document-style double extension
• Genuine multi-volume archives named *.001 opened in 7-Zip by IT staff

Tuning notes: Change index=sysmon to the index holding your Sysmon operational log. Restrict the wsh_double_ext branch to user-writable paths if script hosts are heavily used by admins, and add an exclusion for known signed IT automation. Keep lure_name as a short-lived IOC branch and expire it after the campaign window.

• 🔒 Phishing Email Delivery — Campaign Senders, Lure Subjects, Misleading Archives and Landing Domains (TL-2026-5331) · unlock with TL Creds
• 🔒 Agent Tesla Executable — Campaign Hashes and Double-Extension .exe Run from Archive or Temp Paths (TL-2026-5331) · unlock with TL Creds
• 🔒 Agent Tesla SMTP/FTP Exfiltration from User-Writable Process Paths (TL-2026-5331) · unlock with TL Creds
• 🔒 Entra ID Device Code Flow Sign-In — Salary Review QR Device Code Phishing (TL-2026-5331) · unlock with TL Creds
• 🔒 Browser Credential Store Access by Non-Browser Process in User-Writable Path (TL-2026-5331) · unlock with TL Creds
• 🔒 Script Host or PowerShell Resolving Firebase Storage Payload Host (TL-2026-5331) · unlock with TL Creds
• 🔒 Script Host Spawning PowerShell to Fetch [indicator] from Firebase Storage (TL-2026-5331) · unlock with TL Creds
• 🔒 Endpoint DNS and Network Contact with Campaign Domains and Community-Observed Infrastructure (TL-2026-5331) · unlock with TL Creds

Indicators of compromise for Agent Tesla RAR campaign

As of 2026-11-05, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-5331.

Sample indicators (3 of 20)

• Domain: wekash[.]net
• File hash: BEDD2297739632DA8EE470367295FE976E55BE74D628DCAEE7FA98121EE530F1
• Domain: splace[.]co[.]za

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

Community OSINT corroboration for Agent Tesla RAR campaign

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Agent Tesla RAR campaign works

CAPTCHA-gated phishing rebounded and 94-96% of payload attacks aimed at credential theft.

Microsoft Threat Intelligence's Q3 2026 email threat landscape report (published 2026-11-05) describes roughly 7.3 billion email-based phishing threats between July and September 2026, with September alone near 3 billion (a 41% increase over August). Spoofed business-service messages totalled 129 million (41-46 million per month May-September), with DocuSign the most spoofed brand in September (29%). Microsoft noted that 63% of September spoofed messages that failed authentication and were identified as malicious still carried tenant- or user-level security overrides. Credential theft dominated: 94-96% of payload attacks led to phishing sites or fraudulent sign-in pages. HTML (26-32%), PDF (27-30%) and SVG (13-20%, surging to 10.1 million in August) were the main attachment types, while DOC/DOCX fell to roughly 3-5%.

Campaign 1 (2026-08-19 to 2026-08-20) used personalized 'Salary Review' lures, claiming a Q2 performance-based compensation revision and carrying company branding and recipient names. Mail was sent from smtp@wekash.net through Amazon SES, with the attachment Your-Q3-Compensation-Summary.docx containing a QR code to https://splace.co.za/0987643345678908765421234567890987654320987654321223456787654/onedrive/. The page walked victims through device code phishing: the victim copies an alphanumeric code into the legitimate Microsoft device login portal (microsoft.com/devicelogin), handing the attacker a session token without exposing the password or re-triggering MFA. It reached 10,000+ users in 4,800+ organizations, 72.1% professional services (primarily US legal), 22.5% technology/software and 5.4% other.

Campaign 2 (2026-09-21) was a Spanish-language purchase-order and payroll campaign against 56,000+ users in 8,100+ organizations (Colombia 15%, United States 12%, Mexico 12%, Chile 11%, Spain 8%; retail/consumer goods 27%, manufacturing/agriculture 19%, financial services 13%). Messages came from contacto06@carloxmextos.org, which passed SPF, DKIM and DMARC. Variation A ('Re: solicitud de cotizacion') delivered 'Nuevo orden de compra - 21092026.pdf.uu', a RAR archive with a misleading extension that contained a .pdf.js JavaScript file; that file downloaded Lincoln.ps1 from Firebase Storage, which in turn delivered Agent Tesla. Variation B ('Nomina 21.09.2026') delivered 'Nomina 21.09.2026.xml.001', a RAR archive containing 'Nomina 21.09.2026.xml.exe', an Agent Tesla executable. The lures were date-specific, used personalized greetings and impersonated an HR manager.

The report also documents wider trends: QR code phishing fell to 12.1 million in Q3 (67% below Q2, 86% below the March 2026 peak of 28.3 million by September); CAPTCHA-gated phishing rebounded to 3.1 million in September (double July's low) with SVG attachments the dominant delivery vehicle (17% July, 65% August, 49% September); business contact impersonation totalled 6.2 million; and 141,000 malicious Microsoft Teams call attempts were observed, shifting toward ordinary personal names (46% to 88%) and away from explicit IT/help desk identities (17% to 2%). Tycoon2FA-linked messages fell to 21,000 in July, 99.8% below the February baseline of 8.9 million, after the March 2026 disruption. Microsoft does not attribute either campaign to a named actor. Attribution is therefore Unknown. The BeaconBeagle API returned HTTP 502 for the wekash.net lookup, so no C2 correlation was obtained.

MITRE ATT&CK techniques by tactic:

Credential Access

T1056.001 Keylogging; T1528 Steal Application Access Token; T1555.003 Credentials from Web Browsers

Execution

T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File

lateral-movement

T1550.001 Application Access Token

Initial Access

T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service

Defense Evasion

T1684.001 Impersonation

Remediation for Agent Tesla RAR campaign

Immediate actions

• Block and hunt for sender addresses smtp@wekash.net and contacto06@carloxmextos.org and the domains wekash.net, splace.co.za and carloxmextos.org
• Purge matching messages with Threat Explorer and confirm Zero-Hour Auto Purge is enabled
• Review Entra ID sign-in logs for device code flow authentications and revoke refresh tokens/sessions for affected users
• Search endpoints for Lincoln.ps1, .pdf.js and .xml.exe files extracted from .uu/.001 RAR archives and the published SHA-256 hashes
• Review and remove tenant- and user-level security overrides that allow spoofed or failing-authentication mail

Workarounds

• Block or quarantine inbound RAR archives with unusual extensions (.uu, .001) and script attachments (.js)
• Treat QR codes in documents and SVG attachments in email as untrusted and quarantine them where business need is absent

Longer-term hardening

• Block the device code flow with Conditional Access except where required
• Deploy phishing-resistant MFA (Windows Hello, FIDO2 keys, Microsoft Authenticator passwordless) for privileged accounts
• Enable Safe Links, Safe Attachments, Microsoft Edge SmartScreen and Defender for Endpoint network protection
• Restrict external Microsoft Teams chat, calls and meetings for sensitive roles and block unneeded external Teams users
• Enable automatic attack disruption in Microsoft Defender XDR and run attack simulation training that includes Teams scenarios

Affected and fixed versions

• Microsoft — Microsoft 365 / Entra ID (device code authentication flow)
  Vulnerable versions: Tenants permitting device code flow
• Microsoft — Exchange Online / Microsoft Defender for Office 365 (tenant and user security overrides)
  Vulnerable versions: Tenants with allow/override policies applied to spoofed mail
• Microsoft — Windows (Agent Tesla payload execution)
  Vulnerable versions: Systems permitting execution of .js, .ps1 and .exe from extracted archives

Timeline of Agent Tesla RAR campaign

• 2026-07-01 Start of Microsoft's Q3 2026 observation window; malicious Teams call attempts peak in July at roughly 50,000 and HTML attachments reach their highest monthly share (26-32% range)
• 2026-08-19 Salary Review phishing campaign begins: locked-ioc-9 with a QR code sent from locked-ioc-15 via locked-ioc-20, leading to locked-ioc-16 device code phishing
• 2026-08-20 Salary Review campaign activity ends after reaching 10,000+ users in 4,800+ organizations, primarily US professional services and legal firms
• 2026-08-31 SVG attachment volume peaks for Q3 in August (10.1 million; about sixfold increase), making SVG 65% of CAPTCHA-gated phishing delivery during the month
• 2026-09-21 Spanish-language purchase-order and payroll campaign from locked-ioc-10 delivers locked-ioc-18 through .uu/.001 RAR archives to 56,000+ users in 8,100+ organizations
• 2026-09-30 September closes with nearly 3 billion email-based threats (41% above August) and 3.1 million CAPTCHA-gated phishing messages, double July's low
• 2026-11-05 Microsoft Threat Intelligence publishes the Q3 2026 email threat landscape report with campaign IOCs and advanced hunting queries

Sources cited for Agent Tesla RAR campaign

• H-ISAC TLP White Threat Bulletin: Storm-2372 conducts device code phishing campaign aha.org · Advisory · 2025-02-14
• Email threat landscape: Q3 2026 trends and insights Microsoft · Vendor report · 2026-11-05
• Unmasking Agent Tesla: A Deep Dive into a Multi-Stage Campaign (Gurucul) partner.gurucul.com · Research · 2026-02-26
• Campaign Analysis: Multi-stage delivery of Agent Tesla (Gurucul) community.gurucul.com · Research · 2025-07-15
• Storm-2372 used the device code phishing technique since August 2024 securityaffairs.com · News

More in phishing

• Fake holiday rental booking phishing sites use live chat to harvest traveler credentials and card data
• ChatGPT Subscription Payment Phishing Campaign Using Google API Redirect and Fake Login Page
• Fake OpenAI, SpaceX and Anthropic events used in device code and AiTM phishing to steal Microsoft and Google accounts
• Bank Phishing Campaign Uses Fake 'Suspended' Pages for Returning Visitors to Evade Takedowns
• Suspected MuddyWater Phishing Campaign Impersonating Israel Tax Authority Delivers SimpleHelp RMM to Israeli Organizations

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors