Cybercriminals Mask Password-Stealing Agent Tesla Malware Behind Emojis in New Email Scheme

Cybercriminals are leveraging an unusual tactic to bypass standard email security filters, using colorful emojis to mask a dangerous credential-harvesting malware. Security researchers have uncovered a new business email compromise (BEC) campaign that hides the Agent Tesla v4 info-stealer within JScript code heavily populated with emojis. This campaign specifically targets sensitive credentials stored in web browsers, email clients, and messaging applications.

The attack begins with a highly convincing social engineering lure designed to trick unsuspecting corporate employees. Victims receive fraudulent emails disguised as official bank-payment notifications. These messages urge recipients to review attached or linked files, playing on the urgency typically associated with financial transactions in a corporate environment.

Once a victim interacts with the malicious payload, the attack chain leverages JScript heavily obfuscated with emojis. By embedding these modern symbols directly into the script, the threat actors attempt to confuse traditional static analysis tools and email scanners, which may not be programmed to flag or properly parse scripts containing non-standard characters.

Beyond the emoji-based obfuscation, the campaign employs a fileless execution chain to deliver the final payload. By running the malicious code directly in the system's volatile memory rather than saving physical files to the hard drive, the attackers significantly reduce their digital footprint. This fileless approach makes detection highly difficult for conventional antivirus software, allowing the Agent Tesla v4 malware to run quietly in the background.

Once successfully executed, the Agent Tesla v4 infostealer begins its primary mission: harvesting sensitive data. It specifically targets saved passwords, session cookies, and login credentials across various web browsers, email platforms, and instant messaging services. With these stolen credentials, threat actors can gain unauthorized access to corporate networks, facilitate further financial fraud, or sell the compromised data on underground forums.

This campaign, originally reported by cybersecurity outlet GBHackers, highlights the evolving sophistication of business email compromise schemes. As defense mechanisms improve, bad actors continue to find creative ways—such as exploiting system memory and using unconventional code obfuscation—to slip past modern enterprise defenses. Organizations are advised to train employees on spotting sophisticated payment lures and to implement robust, behavior-based endpoint detection systems.