Daily Summary
Agent Tesla activity reached 76 new samples on 2026-10-18, a 257% increase over the 7-day average of 21. This is the largest single-day count in the current reporting window and reflects a coordinated distribution push rather than isolated submissions. No new C2 servers were observed, which is consistent with reuse of established infrastructure during high-volume email campaigns.
New Samples Detected
The file-type breakdown reveals a notable shift toward script-based delivery. JavaScript files (.js) account for 26 samples, now the largest single category, marginally ahead of 24 .exe samples. Combined with 14 .rar archives, 2 .ps1 scripts, 1 .vbs file, and 2 .bin payloads, script and archive-based delivery makes up the clear majority of today’s volume, while standalone executables are a minority. The 1 .11123991 extension is a malformed or truncated filename rather than a real format, likely a submission artifact or intentionally corrupted extension to evade extension-based filtering. The .js batch arriving with 26 samples in one day is a strong indicator of a single campaign run, as Agent Tesla operators typically batch-compile script variants just before wave distribution.
Distribution Methods
The .js plus .rar pairing is the most common delivery pattern in today’s set, which points to email campaigns using compressed archives containing scripts. This is a well-established ESP evasion approach for Agent Tesla: archives and scripts are less consistently flagged by gateways than raw executables, and users must actively extract and execute the script to trigger infection. The two PowerShell samples are worth flagging for SOC teams. PowerShell stagers are increasingly used to pull the Agent Tesla executable from remote hosts, meaning the .exe samples in today’s batch may represent the second stage of campaigns whose first stage was a script.
7-Day Trend
Today’s count is 3.6x the 7-day average, a clear surge. The timing suggests one or more actors launched distribution waves within a short window, which is consistent with Agent Tesla’s typical use of spam runs followed by quiet periods while operators rotate infrastructure. Absent a change in C2 infrastructure, the volume is more likely to come from expanded targeting than from new tooling.
Security Analysis
The absence of new C2 servers despite a large sample influx is the most telling data point. Agent Tesla operators typically reuse C2 panels and update loader configurations rather than standing up fresh infrastructure, so a volume surge without C2 churn suggests the spam infrastructure (SMTP relays, phishing domains, archive hosting) was rotated rather than the exfiltration backend. This matches the pattern seen in prior Agent Tesla waves and means blocking today’s samples by hash will do little. Defensive priority should be the delivery path: enforce policy that strips .js and .vbs attachments at the email gateway and blocks execution of scripting engines from user-writable directories such as Downloads and Temp. Given the PowerShell stagers in this set, also alert on script-block events spawning PowerShell with encoded or download-cradle arguments. Where feasible, quarantine newly downloaded .rar archives pending user confirmation.