Daily Summary
Agent Tesla activity more than doubled today, with 100 new samples collected against a 7-day average of 47. That is a 113% surge and the highest single-day count in the current reporting window. The spike is driven almost entirely by JavaScript-based delivery, which now accounts for the clear majority of volume.
New Samples Detected
The file type mix is the story today. JavaScript files (.js) account for 68 of 100 samples, with a further variant-tagged .jse and .js$ bringing script-based loaders to roughly 70% of the day’s haul. Executables (.exe) trail at 18, with a small .exe$ tail. VBScript (.vbs, .vbs$) and batch (.bat$) together contribute 8, and a single .com file rounds out the set. This is a pronounced shift toward scripted stagers over standalone PE binaries. Script-based delivery lowers the barrier for attackers: obfuscated JS can be dropped by a commodity phishing kit, rewritten per victim, and executed by the Windows Script Host without requiring a signed or packed executable. The suffix-tagged entries (.exe$, .bat$, .js$, .vbs$) indicate samples that were saved with modified extensions, a common artifact of email gateway attachment filtering, where senders append a character to evade naive blocklists.
7-Day Trend
Today’s count is 2.1x the 7-day average, well beyond normal daily variance. The surge is concentrated in a single file type rather than spread evenly across the mix, which argues against organic growth and toward a coordinated distribution push, likely a phishing wave or a freshly deployed loader kit. With zero new C2 servers logged, the infrastructure is riding on existing command-and-control, suggesting the operators are scaling distribution on proven backend rather than standing up new panels.
Security Analysis
The pattern here is a classic Agent Tesla distribution refresh: keep the C2 stable, flood a new script-based loader, and rely on the volume of fresh, uniquely obfuscated samples to outpace signature updates. Because no new C2 servers appeared, defenders should assume the existing infrastructure is now handling more check-ins and that the loaders are being regenerated per campaign. The heavy JS weighting is consistent with script-delivery waves seen in prior Agent Tesla phishing pushes, where weaponized attachments masquerade as invoices, shipping notices, or document links and invoke WScript or cscript on execution.
Actionable recommendation: prioritize behavioral detections over file hashes for this wave. Alert on wscript.exe and cscript.exe spawning from mail client or browser parent processes, on script interpreters making outbound HTTP/S connections to non-corporate destinations shortly after execution, and on Office or archive extraction writing .js/.jse/.vbs files to user-writable paths. Because IOCs rotate with each obfuscation pass, treat today’s 100 hashes as ephemeral and lean on script-host telemetry and DNS/HTTP egress monitoring to catch the runtime behavior that persists across variants.