Tax Phishing - AgentTesla Keylogger Delivery (T1056.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Identifies the hallmark behavior of AgentTesla (frequently delivered via tax lures) injecting into RegAsm and attempting SMTP/FTP exfiltration.