Daily Summary
Agent Tesla activity surged sharply on July 12 with 94 new samples, a 75% increase over the 7-day average of 54. Detection volumes have risen for the third consecutive day, driven primarily by a large wave of JavaScript-based loaders. No new C2 infrastructure was observed, suggesting threat actors are reusing existing command channels to distribute today’s payloads.
New Samples Detected
JavaScript files dominated today’s haul, accounting for 62 of 94 samples (66%). This is a pronounced shift from the typical mixed distribution of EXE and VBS files seen earlier in the week. The JS files are likely acting as downloaders or loaders, often disguised as invoice-themed filenames. Only 21 EXE files were directly captured, while compressed formats (.tar, .rar) and supporting elements (.dll., .hta, .ps1) made up the remainder. The low count of .ps1 files (1) is consistent with recent declines in PowerShell-based delivery.
Detection Rate
Preliminary analysis of the JS samples indicates multiple layers of obfuscation, including base64 encoding and string splitting techniques commonly associated with recent Agent Tesla campaigns. The shift to script-based loaders may be an attempt to evade signature-based detection on email gateways, as JavaScript files are often scanned less aggressively than executable attachments.
7-Day Trend
Today’s sample count of 94 is 75% above the 7-day average of 54, marking the second highest single-day volume in the past week. This follows a period of relatively steady activity (45–58 samples per day from July 6–10) and represents a clear escalation. Analysts should anticipate this surge may continue as threat actors capitalize on the current campaign’s success.
Security Analysis
The pivot to JavaScript-heavy delivery is notable given that prior Agent Tesla surges in mid-2025 relied predominantly on ISO and LNK files. This shift may reflect a broader trend in the malware ecosystem toward cross-platform script loaders that can be executed across Windows and macOS environments, or simply a test of new vendor detection gaps. Defenders should ensure their email security tools are configured to sandbox .js attachments with explicit execution analysis, as static scanning alone is unlikely to catch the obfuscation techniques observed today.