Daily Summary
Agent Tesla activity dropped sharply on 2026-08-30, with 45 new samples detected against a 7-day average of 75, a 40% decline. The downward trend is driven primarily by a collapse in .js payload delivery, which fell to 31 samples from a recent daily norm exceeding 60. No new C2 infrastructure was observed, and the day’s collection is best characterized as residual noise rather than an active campaign shift.
New Samples Detected
The file-type distribution today shows a notable structural change hidden within the raw numbers. While .js files still dominate at 31 samples, their share of the total (69%) is the lowest observed this week. More telling is the composition of the non-script payloads: all five .exe files and the single .hta file share identical compilation timestamps and identical signature blocks, indicating they came from a single builder run. This suggests one operator recycled a previously successful campaign template rather than a broader ecosystem-wide adjustment.
The two .rar archives are also worth noting. Both contain password-protected executables with the password hardcoded in the accompanying .bat launcher scripts, a technique that has appeared in only three other samples in the past 14 days. This marks the first time in a week that archive-based delivery has reappeared, possibly signaling an operator experimenting with lower-volume, higher-stealth distribution.
7-Day Trend
Today’s 40% decline against the 7-day average qualifies as a significant deviation, but context matters. The drop is almost entirely attributable to a single source: .js sample volume fell by roughly 50% compared to the previous three days. Non-script payloads (exe, vbs, bat, hta, rar) are actually up 12% versus the same period. This is not a general retreat in Agent Tesla activity but rather a contraction in one delivery channel, likely indicating a phishing campaign that ended or rotated infrastructure.
IOC Highlights
All 45 new IOCs were collected today, but they cluster into two distinct groups. Thirty-eight are file hashes tied to the .js and .vbs scripts, which share overlapping obfuscation routines and identical C2 retrieval URLs. The remaining seven are unique artifacts: five email subject lines extracted from the .js payloads, one MZ header offset shared across the five .exe files, and one PowerShell download cradle string reused in both .bat files. The email subjects all follow a “Pending Invoice [random number]” pattern, consistent with the lure templates used in earlier 2026 Agent Tesla campaigns targeting finance departments.
Security Analysis
The split between declining script volume and steady or rising binary payloads is a pattern not typically seen in Agent Tesla’s normally synchronized campaign cycles. Historically, script-based delivery (js/vbs) and compiled payloads rise and fall together, as they are usually generated by the same builder and pushed through the same spam runs. The divergence today suggests two independent operators are active: one winding down a script-based operation, another quietly testing archive and binary delivery paths. The reused MZ header offset across all five .exe files points to a single builder configuration, meaning one group is deliberately scaling back while another is probing detection rates with a smaller, hand-tuned batch.
The actionable recommendation is to treat the five .exe files as high-priority indicators regardless of their low volume. Their uniform build characteristics make them an ideal fingerprint for future samples from the same operator. SOC teams should add the MZ header offset and the shared C2 retrieval URL to their detection rules, as these will catch both today’s binaries and any subsequent rebuilds before file hashes are published. Additionally, given the password-protected .rar technique reappearing, email gateway rules should flag any inbound archive attachments paired with batch scripts, regardless of whether the archive password is visible in the body.