Hackers are using Unicode emoji characters to hide an Agent Tesla JScript dropper in a business email compromise campaign aimed at finance teams.
The tactic turns a payment-related attachment into a difficult-to-read script while leaving malicious instructions ready for Windows to execute.
A forwarded wire-transfer email impersonates Metropolitan Bank and Trust Company. It urges recipients to confirm an attachment, using urgency and a believable banking context to get someone to open a 6.94 MB JavaScript file.
Researchers at KnowBe4 identified the activity and tracked it as an Agent Tesla v4 operation. The attachment, named as a SWIFT payment document, launches a chain that keeps the final credential-stealing program out of sight on the victim’s disk.
The risk extends beyond one stolen password. The malware can collect browser logins, email credentials, messaging data and Windows secrets, giving criminals material for account takeover, follow-on phishing and payment fraud.
KnowBe4 said in a report shared with Cyber Security News (CSN) that its focus on finance staff makes the campaign dangerous for organizations handling vendor payments.
Hackers Hide Agent Tesla JScript Behind Unicode Emojis
The attached JScript file is packed with hearts, water droplets and other Unicode emoji characters inserted through its code.
Windows Script Host ignores those characters when it parses the script, but the visual clutter can frustrate quick reviews and weaken simple text-based detection rules.
This is not merely an unusual file format trick. As explained in coverage of emoji code concealment methods, Unicode can create a gap between what an analyst or security filter sees and what a program ultimately interprets.
In this case, the hidden-looking code still runs when the attachment is opened. The dropper writes a loader and font-disguised file to the public Libraries folder.
It then uses DonutLoader shellcode to load the final .NET payload into memory, reducing evidence for scanners looking only for suspicious files.
.webp)
The campaign does not rely on a second-stage download. That removes one possible network detection point and makes the initial attachment especially important for defenders to stop.
The final payload presents itself as a Python installer in its program information, although analysts found a 32-bit .NET 4.0 binary instead. This kind of mismatch is a hunting clue, as is the combination of an oversized script, a payment lure and JScript execution.
Credential Theft And Defense
Before stealing information, Agent Tesla checks whether it is running under a debugger, in a cloud-hosted environment or inside a virtual machine. It also looks for software associated with analysis. If those checks indicate scrutiny, the malware exits rather than reveal its behavior.
Once active, it targets logins from 27 Chromium-based browsers and 13 Mozilla-based browsers, along with Outlook, Foxmail, Discord, Thunderbird contacts and Windows Credential Manager.
Readers following recent Agent Tesla campaigns will recognize a pattern of phishing, obfuscated scripts and memory-based execution. The operators send captured data through FTP and attach a hardware identifier to help track victims.
The sample includes keylogging, clipboard and screen-capture capabilities, although those features were disabled in the configuration examined by researchers. Such options can be enabled in other builds.
Organizations should block or tightly control script attachments, especially .JS files delivered in payment conversations, and review email controls for spoofed brands and forwarded-thread lures.
Finance teams should independently verify payment requests through a known contact route, a safeguard also relevant to early BEC attack detection.
Security teams should investigate hosts that contacted the listed infrastructure, isolate affected systems and reset every credential that was available on them.
Browser, email, Windows Vault and active messaging-account credentials require rotation because the collection routine runs immediately after execution.
Detection engineers can look for JScript-specific behavior combined with the unusual Unicode code points used by the dropper, rather than relying solely on conventional file signatures.
Monitoring unusual in-memory .NET loading and outbound FTP can cover the multi-stage Agent Tesla delivery documented in this case.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Attachment filename | SWIFT Payment Maker 103 - 10.06.26.JS | Malicious JScript attachment used in the phishing lure |
| SHA-256 | 615f9ecc51ccce0de6e88dcff70662f77965214bf5ad0cc7e07bc4fae72c40d0 | SHA-256 hash of the malicious attachment |
| Sender impersonation | Metropolitan Bank and Trust Company (Philippines) | Brand impersonated in the business email compromise lure |
| Dropped file | C:UsersPublicLibrarieswabmmxofrrdsjlsx.exe | 32-bit .NET loader written by the dropper |
| Dropped file | C:UsersPublicLibrarieswabmmxofrrdsjlsx.ttf | Encoded Agent Tesla payload blob disguised as a font file |
| FTP C2 hostname | ftp[.]melrz[.]com | FTP command-and-control and data-exfiltration host |
| C2 IP address | 162[.]0[.]209[.]89 | Resolved address for the FTP host; observed with TCP ports 21 and 12038 |
| Configuration URL | ftp://ftp[.]melrz[.]com | FTP configuration URL extracted from the malware binary |
| FTP credentials | info@melrz[.]com / Newmoney2023.. | Plaintext credentials embedded in the malware configuration |
| Hosting check URL | hxxp://ip-api[.]com/line/?fields=hosting | Callback used to determine whether the host is a cloud or hosting environment |
| Hosting check IP | 208[.]95[.]112[.]1 | Resolved address associated with the hosting-check service |
| Assembly product | Python 3.11.3 (64-bit) | Deceptive payload metadata |
| Assembly company | Python Software Foundation | Deceptive payload metadata |
| Assembly title | setup | Deceptive payload metadata |
| Assembly UUID | f45b853c-c9d3-495e-9acb-d41a4a90029f | Unique identifier embedded in the payload |
| Sandbox-evasion DLLs | snxhk.dll, cmdvrt32.dll, SbieDll.dll, SxIn.dll, Sf2.dll | DLL names checked to identify security products or analysis environments |
| Persistence binary path | %APPDATA%eCXCESeCXCES.exe | Potential startup payload location if persistence is enabled |
| Persistence registry value | HKCUSoftwareMicrosoftWindowsCurrentVersionRuneCXCES | Potential Run key used for persistence if activated |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
