Daily Summary
Agent Tesla activity surged on 2026-10-11 with 69 new samples, a 272% increase over the 7-day average of 19. The spike is driven almost entirely by JavaScript loaders, which accounted for 52 of 69 samples (75%), representing a sharp pivot from the executable-heavy distribution seen in prior weeks.
New Samples Detected
The file type distribution reflects a deliberate shift toward script-based delivery. JavaScript (.js) dominates at 52 samples, with PowerShell (.ps1) at 9, VBScript (.vbs) at 4, and only 3 PE executables (.exe) plus a single .hta file. Notably absent are the .xls/.xlsx macro documents that historically anchored Agent Tesla campaigns. This indicates the operators have moved away from Office macro dependency, likely in response to Microsoft’s continued hardening of macro execution defaults. The heavy JS concentration suggests either a single high-volume email campaign or coordinated use of a shared loader generator.
Distribution Methods
The overwhelming JS majority points to archive-based phishing: .js files are typically delivered inside ZIP or RAR attachments, or via HTML smuggling to bypass gateway inspection. The near-total absence of macro documents reinforces this. The 3 .exe samples may be secondary payloads dropped post-execution rather than initial droppers, consistent with Agent Tesla’s two-stage model where a script fetches the final stealer binary.
7-Day Trend
Today’s 69 samples are 3.6x the 7-day average of 19, well beyond the >25% deviation threshold. This is not routine variance. Combined with the JS concentration, it suggests a new campaign wave rather than organic uptick. Analysts should expect elevated volumes over the next 48-72 hours as the campaign distributes.
IOC Highlights
All 69 samples yielded new IOCs (69 total), though zero new C2 servers were registered. The absence of new C2 infrastructure alongside a sample surge is notable: the campaign is reusing existing delivery infrastructure while rotating payload hashes, a cost-efficient evasion pattern. Tracking the 69 IOCs against known infrastructure will clarify whether these are repacked variants or new builds.
Security Analysis
The disconnect between 69 new samples and 0 new C2 servers is the key signal. In prior Agent Tesla waves, sample surges typically accompanied at least some C2 rotation. Here, operators appear to be recycling existing command infrastructure while generating fresh loader hashes, a pattern consistent with hash-based detection evasion rather than infrastructure rebuild. This mirrors behavior seen in prior Agent Tesla campaigns where threat actors prioritize polymorphic loaders over new backend servers. Defenders relying on static hash blocklists will miss these samples entirely. Recommended action: prioritize behavioral detection over file hashing, specifically monitoring for script interpreters (wscript.exe, powershell.exe) spawning network connections or child processes, and inspect archive attachments containing .js files aggressively. Hunt for the reused C2 endpoints, since their persistence is the most reliable detection anchor this wave offers.