Agent Tesla v4 hides in emoji and never hits disk: an email-rule problem, not a new-malware one

KnowBe4 researchers logged an attempted delivery of Agent Tesla version 4 via a business email compromise lure aimed at finance departments, and published their analysis on August 20 ^[1][25]. Nothing about the payload's ambitions is new; what has changed is that the delivery chain breaks string-based signature matching and file-based scanning at the same time, which leaves the mail gateway and script-level rules as the enforcement points ^[26].

The lure did the unglamorous work. According to KnowBe4, the message arrived as a forwarded thread presenting as internal correspondence passed to a contact of the account ^[3], with the address of Metropolitan Bank and Trust Company, a Philippines-based commercial bank, spoofed as the sender ^[4]. The thread was built to look like an in-progress discussion the recipient had been brought into late, with a direct instruction to confirm the attached document and reply ^[5]. That is indistinguishable from a normal accounts-payable Tuesday.

The attachment is a JScript dropper that can be launched from a simple open-with dialog ^[6]. Its body is interleaved with Unicode emoji characters, hearts and water droplets among them ^[7], which disrupt string-based signature matching and make the code visually noisy enough to defeat casual review ^[8]. On execution the script writes two files to C:\Users\Public\Libraries\, one of which is misdirection, and the extension is passed into DonutLoader shellcode for reflective PE injection ^[9]. The final Agent Tesla binary never touches the filesystem, so file-based scanners have nothing to open ^[10].

The payload itself is a catalogue of the usual defences: obfuscation with ConfuserEx ^[11], embedded metadata presenting the assembly as a Python installer ^[12], and a standard Windows debugger check that halts execution if it finds a debugger attached ^[13]. Before collection it builds a persistent hardware fingerprint so operators can track a victim across reinstalls and IP rotation ^[14], and it disables validation for all outgoing connections to keep C2 traffic from raising alerts or errors ^[15]. Collection covers browsers, messaging platforms and native Windows credential repositories ^[16] across more than 40 applications ^[17], plus keystroke and clipboard capture ^[18]. Every exfiltrated file carries a header with timestamp, username, computer name, OS, CPU, RAM, public IP and the MD5 hardware ID ^[19].

The operational detail that should shape your playbook is the timing. KnowBe4 reports the credential dump lands on the attacker's FTP server within seconds of execution, with no delayed staging ^[20], sent to a single threat actor-controlled domain ^[21]. There is effectively no dwell window between click and credential loss, so post-execution containment is a rotation exercise, not an interception one ^[27].

The mitigation KnowBe4 proposes is correspondingly cheap. The firm says the emoji obfuscation does not survive any YARA rule looking for the Unicode code points used alongside JScript-specific patterns ^[22], and states that "a rule matching both the emoji distribution pattern and WScript.Shell or CreateObject calls will catch this family" ^[23]. Their advice to defenders is to update email security rules rather than wait for the endpoint to catch it ^[24].

Two things worth checking this week. First, whether your mail filtering inspects script attachments at the code-point level at all, since that is the specific gap the technique exploits ^[22]. Second, whether finance staff have any procedure that treats being forwarded into a live thread late, with an instruction to confirm an attachment, as a reason to verify out of band ^[5].