Hackers Hide Agent Tesla JScript Behind Unicode Emojis to Evade Detection

Hackers are using Unicode emoji characters to hide an Agent Tesla JScript dropper in a business email compromise campaign aimed at finance teams. The tactic turns a payment-related attachment into a difficult-to-read script while leaving malicious instructions ready for Windows to execute. A forwarded wire-transfer email impersonates Metropolitan Bank and Trust Company. It urges recipients to confirm an attachment, using urgency and a believable banking context to get someone to open a 6.94 MB JavaScript file. Researchers at KnowBe4 identified the activity and tracked it as an Agent Tesla v4 operation. The attachment, named as a SWIFT payment document, launches a chain that keeps the final credential-stealing program out of sight...

Read the full article at the source.