Daily Summary
Agent Tesla activity rose sharply on 2026-10-25 with 67 new samples collected, a 161% increase over the 7-day average of 26. This is the largest single-day volume in the current reporting window and marks a clear departure from the steady baseline seen over the past week. Notably, the surge was not accompanied by any new C2 servers, suggesting distribution capacity expanded rather than backend infrastructure.
New Samples Detected
The file type breakdown is the most informative signal today. JavaScript files account for 34 of 67 samples (51%), more than double the count of executables (22). This reverses the usual pattern for Agent Tesla, where .exe loaders typically dominate. The remaining samples are a long tail of script and archive formats: 4 .ps1, and one each of .vbs, .rar, .zip, .tar, .iso, .bat, and .msi. This spread across nine secondary formats points to a multi-stage delivery chain where the .js file serves as the initial dropper, with archive and script types providing fallback execution paths. The presence of .iso and .msi alongside .js is consistent with campaigns that package loaders inside disk images or installer wrappers to bypass Mark-of-the-Web controls.
7-Day Trend
Today’s count of 67 is 2.6x the 7-day average of 26, well beyond the 25% deviation threshold that would flag a routine fluctuation. A surge of this magnitude, combined with the shift toward script-based loaders, suggests an active distribution campaign rather than organic sample discovery. Security teams should treat the next 48 to 72 hours as elevated risk for Agent Tesla delivery.
IOC Highlights
All 67 samples generated new IOCs, but zero new C2 servers were registered. That gap is itself an indicator: operators are reusing existing command-and-control infrastructure while rotating loader samples. Defenders should prioritize hunting on the new file hashes and delivery artifacts rather than waiting for new network indicators, which are unlikely to appear.
Security Analysis
The combination of a 161% volume surge with zero new C2 infrastructure is a recognizable pattern. It resembles infrastructure-reuse behavior seen in older Agent Tesla distribution waves, where operators keep a stable backend and simply refresh the loader layer to outpace signature detection. What is less common here is the heavy pivot to .js droppers. Previous Agent Tesla surges have typically leaned on Office macro documents or .exe loaders; a majority-JavaScript distribution wave suggests the operators are testing a fresh delivery technique against current filtering. For SOC analysts, the actionable step is to add file-hash detection for today’s 67 samples to endpoint allow/deny policies and to review JavaScript execution policy (e.g., wscript/cscript invocation logging) on user endpoints. Because the C2 layer is unchanged, existing network blocklists should still catch post-infection traffic; the defensive gap is at the execution stage, not the network stage. Prioritize script-block-logging coverage and browser download inspection for .js and .iso content over the next several days.