Security researchers have identified a sophisticated malware campaign utilizing Agent Tesla variants delivered through elaborate multi-stage attack sequences. Broadcom researchers noted that these Agent Tesla variants employ particularly sophisticated obfuscation techniques, making detection increasingly challenging for conventional security tools. Researchers have identified multiple protection mechanisms that can detect various stages of this attack, including behavior-based detection of suspicious PowerShell activities and network monitoring for unexpected connections to certificate authorities. This PowerShell script serves as the delivery mechanism for the final Agent Tesla payload, which gets loaded directly into memory and injected into legitimate Windows processes to maintain persistence while evading detection. “The threat actors behind this campaign have demonstrated advanced capabilities in designing multi-stage attacks that can bypass many standard security measures,” explained the research team in their analysis. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The malware operation, discovered in mid-April 2025, leverages PowerShell scripts as a critical component in its infection chain, demonstrating increased technical complexity compared to earlier variants. Organizations should implement comprehensive security measures including email filtering, PowerShell logging, and advanced endpoint protection to mitigate these threats effectively. The emergence of these sophisticated Agent Tesla variants highlights the continuing evolution of malware delivery techniques. The modular nature of the attack allows threat actors to adapt their techniques quickly when detection measures improve. The malware utilizes process hollowing techniques to replace the code of a legitimate process with its malicious code, allowing it to operate under the guise of trusted system processes. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The infection sequence begins when users open the malicious attachment, triggering a hidden JavaScript file that initiates the attack chain.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 17 Apr 2025 10:45:04 +0000