Daily Summary
Agent Tesla telemetry recorded 35 new samples today, a 26% increase over the 7-day average of 28. The rise is driven almost entirely by JavaScript-based droppers, which account for 27 of 35 samples (77%), a considerable departure from the more balanced loader mix seen over the prior week. No new C2 servers surfaced, though each new sample carries its own IOC set.
New Samples Detected
The file type split is the story today: .js files dominate at 27, with the remainder scattered across .rar (2), .xlam, .com, .vbs, .msi, .exe, and a single sample with a random numeric extension (.2461). That long tail is typical of loader diversification, but the .js concentration is unusual. The lone .2461 sample is worth flagging for triage, as extensionless or nonstandard suffixes often indicate a payload disguised for double-click execution on misconfigured systems. The .xlam sample suggests at least one Excel add-in delivery thread remains active in parallel to the scripts.
Distribution Methods
JS-heavy delivery in Agent Tesla activity typically maps to phishing lures distributing archive files containing a script, or HTML smuggling where the JS is reconstructed in-browser. The presence of .rar and .com alongside the JS files fits a chain where an archive or compiled script stub hands off to a WScript-based loader. Security teams should prioritize inspecting email gateways for .js attachments nested inside archives, and proxy logs for script retrieval from low-reputation hosts.
7-Day Trend
At 35 samples against a 28 average, today clears the >25% deviation threshold for a rising trend. This is a moderate bump rather than a spike, but combined with the loader shift it suggests either a fresh campaign push or a single actor ramping distribution. Worth watching whether the JS proportion holds over the next 48 hours.
Security Analysis
The striking absent signal is zero new C2 servers despite 35 new samples. In Agent Tesla campaigns, fresh sample waves usually correlate with new exfiltration endpoints as operators rotate infrastructure. Here, new samples appear to reuse existing C2, implying the actors are focused on delivery and volume rather than rebuilding backend. That lowers the value of domain-based blocking as a sole control and raises the importance of behavioral detection. Recommended action: alert on wscript.exe or cscript.exe spawning from archive extraction paths or Office parent processes, since JS-loader chains rely on this parent-child pattern and it will catch samples regardless of which reused C2 they call.