Executive Summary
Agent Tesla is a long-standing and active .NET-based information stealer observed since 2014, classified by CISA as one of the top malware strains. It operates as a Malware-as-a-Service (MaaS) tool, utilized by threat groups such as TA2541 and SilverTerrier to harvest sensitive data. The malware is primarily delivered via phishing campaigns masquerading as invoices, purchase orders, or payroll notices to entice users into executing malicious attachments.
Technically, Agent Tesla employs process hollowing to inject its payload into legitimate processes and achieves persistence through new registry run keys and scheduled tasks. Once active, it captures keystrokes, system information, and credentials from web browsers, mail clients, and FTP services. Exfiltration occurs via SMTP, FTP, or HTTP, providing attackers with the necessary data to facilitate further fraud, account takeovers, or business email compromise (BEC) attacks.
The impact of an infection is severe, as stolen credentials can be leveraged across an organization's cloud services, VPNs, and email accounts. Organizations must treat an Agent Tesla infection as a comprehensive credential breach, necessitating an immediate reset of all typed or stored credentials from the affected machine and the revocation of active sessions across associated services.