TEASOUP JS Obfuscator Artifacts

Duo Tech@duotech

•updated Jun 8, 2026•1•0•6

Detects the presence of specific string artifacts related to the TEASOUP JavaScript obfuscator within script blocks. TEASOUP is heavily used by the Russia-nexus threat group GREYVIBE to obfuscate initial access payloads in PhantomMail campaigns.