Daily Summary
Agent Tesla detections declined sharply on 2026-08-23, with only 50 new samples logged against a 7-day average of 77, a 35% drop. This marks the lowest single-day count in the tracking window to date. The decline is broad-based rather than concentrated in a single vector, but the distribution profile shifted noticeably toward JavaScript-first delivery.
New Samples Detected
The file-type breakdown today is atypical for Agent Tesla campaigns. JavaScript files dominate at 29 of 50 samples (58%), a significant deviation from the historical mix where executables and archive-based payloads lead. Traditional .exe samples fell to just 8, and compressed formats (.rar, .7z, .zip combined) accounted for only 8. Notably, a single sample with the unusual extension .52173122 appeared, alongside isolated .vbs, .ps1, .xlam, and .xla files. The elevated JavaScript share suggests actors are prioritizing script-based delivery, likely as an initial access layer that fetches the final Agent Tesla binary in-memory or from a remote source, reducing the malware’s on-disk footprint during early infection stages.
Distribution Methods
The dominance of .js files points to a shift toward phishing emails with JavaScript attachments or links to hosted scripts, rather than the more common zipped executable or Office macro chains. This tactic is frequently paired with lure themes like invoice notifications or shipping confirmations, but the payload is staged through a multi-step download. The presence of both .xlam and .xla samples shows continued but minor use of Excel add-in vectors. The low overall volume suggests this is a targeted campaign rather than a broad spam wave, consistent with actors testing new delivery infrastructure before scaling operations.
7-Day Trend
Today’s 35% deviation from the 7-day average warrants attention. Comparing the last three days shows a descending sequence: 88 samples on 2026-08-21, 71 on 2026-08-22, and 50 today. This is not a random fluctuation but a steady contraction. The absence of any new C2 servers registered today reinforces the interpretation that this is a deliberate slowdown, possibly tied to campaign rotation or operators pausing distribution while they retool evasion techniques.
IOC Highlights
All 50 samples produced new IOCs, but with zero new C2 domains or IPs, the indicators are limited to file hashes and the associated JavaScript paths. Analysts should prioritize ingesting the 29 JavaScript hashes, as these represent the active campaign’s current delivery artifacts. Given the unusual .52173122 extension, any file with that suffix in email gateways or endpoint telemetry should trigger immediate quarantine and deeper inspection.
Security Analysis
The shift to JavaScript-heavy delivery with no concurrent C2 registrations is notable. Historically, Agent Tesla operations interleave new C2 setup with distribution spikes; today’s pattern - high script volume, no new infrastructure - suggests operators are reusing existing C2 pools while testing whether script-based initial access improves their infection rates. The .52173122 extension, likely a renamed executable or obfuscated artifact, hints at experimentation with polymorphic naming to bypass extension blocklists. For defenders, the actionable move is to update email filtering rules to treat JavaScript attachments with heightened scrutiny, specifically blocking or sandboxing .js files originating from external senders unless explicitly expected, and to ensure endpoint detection rules flag script execution that subsequently spawns PowerShell or contacts known Agent Tesla sinkholes.