Agent Tesla

Agent Tesla is a well-known malware that primarily targets systems through phishing attacks, exploiting an outdated Microsoft Office vulnerability (CVE-2017-11882). This malicious software is designed to infiltrate computer systems, often without the user's knowledge, and can steal personal information, disrupt operations, or hold data for ransom. Its spread has been facilitated by phishing campaigns that trick users into downloading it, often under the guise of legitimate emails or downloads. The malware was linked to a person known as @Mack_Sant (also identified as @Fucosreal) who was revealed as the originator of the Agent Tesla campaign, according to research conducted by Check Point Research (CPR). The researchers were able to recover data from computers associated with this individual, confirming their involvement in the campaign. Conversations between @Mack_Sant and another individual, Sty1x, further implicated them in testing the capabilities of another malware, Styx Stealer, using the Agent Tesla bot. During their investigation, CPR researchers found a connection between the developers of Styx Stealer and one of the Agent Tesla threat actors. The creator of Styx Stealer had inadvertently revealed his personal details, including Telegram accounts, emails, and contacts, while debugging the stealer on his own computer. This oversight led to the identification of the malware author as an individual operating out of Turkey, demonstrating the occasional operational security lapses even among threat actors. This discovery also provided insight into the broader network of malware operators, revealing competitors such as Redline and Vidar.