Agent Tesla steals passwords and keystrokes through phishing attachments. See how an attack unfolds, which controls break the chain, and how to respond.
Agent Tesla is a long-running .NET infostealer that logs keystrokes, steals saved passwords, and sends them to attackers. It has been seen since at least 2014 and is still active. It arrives mostly through phishing emails with attachments that look like invoices or orders. Stopping it means blocking the attachment, limiting what can run, watching outbound traffic, and treating every credential on an infected machine as stolen.
MITRE ATT&CK describes Agent Tesla as a spyware Trojan written for the .NET framework that has been observed since at least 2014. It lists the primary delivery method as email phishing messages with a malicious attachment.
So what it steals is broad. MITRE notes that it can log keystrokes, capture screenshots, and gather credentials from browsers, FTP clients, and wireless profiles. It also collects system details, so attackers learn what they have infected.
CISA lists Agent Tesla among the top malware strains of 2021 and notes that criminals used it for at least five years. It belongs to the malware-as-a-service world, where developers write the malware and distributors sell it on to others. That is why it stays common. A low-skilled criminal can rent a working tool, and it sits alongside other types of malware in the same market.
Each stage of an attack leaves something a defender can see.
| Stage | What happens | What to watch |
|---|---|---|
| Lure | An email with an invoice or order attachment arrives | Unexpected attachments, especially from new senders |
| Open | The user opens the attachment | Documents or archives that launch scripts |
| Load | A loader runs and injects the payload into a legitimate process | Process injection, known as process hollowing |
| Hide | The malware obscures its code and stops analysis tools | Security tools that stop unexpectedly |
| Persist | It adds itself to startup entries or scheduled tasks | New registry run keys and scheduled tasks |
| Steal | It collects passwords and keystrokes | Reads of browser and mail credential stores |
| Send | It exfiltrates the data over SMTP, FTP, or HTTP | Outbound mail or file transfer from endpoints |
MITRE documents each of these behaviors, including process hollowing, persistence through registry and scheduled tasks, and exfiltration over SMTP, FTP, and HTTP. The last row is useful for defenders. An ordinary laptop rarely needs to send mail or upload files by itself. Attachments are also not limited to Office files, since PDFs can deliver malware too.
Discover how Threatcop protects your workforce from modern cyber threats.
An infostealer is rarely the end of the attack. Instead, it is the supply line. Stolen mail logins let an attacker read a mailbox, learn who pays whom, and send convincing requests. Stolen browser passwords open cloud services and VPNs.
That is why an Agent Tesla infection should never be treated as a single-machine problem. The data it takes can be used days later, from a different place. Credential harvesting of this kind fuels much of the fraud seen in business email compromise cases.
MITRE lists TA2541 and SilverTerrier among the groups that use Agent Tesla. It shows how a commodity tool serves more than one kind of criminal.
MITRE lists email phishing with a malicious attachment as the primary delivery method. So the lure is the first place to stop an Agent Tesla attack. These are common signs, and staff can learn them in minutes.
If any sign appears, do not open the file. Report it instead.
No single control stops Agent Tesla. Layer controls so that one missed step does not end in a loss.
After an Agent Tesla infection, assume the worst about what the machine held. The steps below are in order.
Agent Tesla needs a person to open the attachment. That also gives a person the chance to stop it, though. A staff member who finds an invoice they did not expect, and reports it instead of opening it, ends the attack at step one.
Threatcop Phishing Incident Response (TPIR) makes that report a one-click action from email or WhatsApp. Employees can check a message’s threat level before they decide. TPIR then runs header analysis, link and attachment scanning, an IP reputation check, and fake domain checks in a sandbox. So the security team gets an assessment of the attachment rather than a guess.
Its “Who Else” insight then shows which other mailboxes received the same message. Genuine mail returns to the inbox, and TPIR deletes malicious mail. Because infostealer campaigns go out in bulk, removing the message from every inbox matters as much as the first report.
Agent Tesla is old, cheap, and effective, which is why it lasts. It works because someone opens an attachment, and it pays off because the stolen logins get used elsewhere. So defend each step. Block and sandbox risky attachments. Limit scripts and outbound mail from endpoints. Keep passwords out of browsers and protect accounts with MFA. When it appears, treat the whole machine as breached and reset every credential it held. Finally, give staff a one-click way to report the invoice they did not expect, because that report stops the chain before the malware ever runs.
Agent Tesla is a .NET spyware Trojan and infostealer, observed since at least 2014. It logs keystrokes, captures screenshots, and steals saved credentials from browsers and other applications. Attackers sell and rent it, so many different criminals use it.
MITRE lists email phishing with a malicious attachment as its primary delivery method. The email often looks like an invoice, purchase order, or payroll notice. The attachment launches the infection when a user opens it. Learning to recognize phishing emails helps stop that step.
Agent Tesla steals keystrokes, screenshots, and saved credentials from browsers, FTP clients, and wireless profiles. It also gathers details about the infected system. Attackers then use the stolen logins for fraud, account access, or further attacks.
Watch for process injection, new registry run keys or scheduled tasks, and endpoints sending mail or uploading files over SMTP, FTP, or HTTP. Endpoint detection tools can catch these behaviors, and staff reports can catch the lure before it runs.
Isolate the device, then treat every credential on it as stolen and reset them from a clean device. Revoke active sessions, check mailbox rules, review outbound connections, and remove the original email from other mailboxes. Handling it as a credential breach, not a single infection, limits the damage.
Shikha Mishra is responsible for driving the growth and adoption of TDMARC, a flagship product of Threatcop, across India, the Middle East, APAC, and the UK region. With her expertise, she helps organizations safeguard their domains so that no hacker can misuse them to send fraudulent emails, thereby protecting both their brand and reputation. She is passionate about enabling businesses to simplify the complexities of outbound email security through TDMARC’s comprehensive solution, allowing them to stay focused on what matters most to their success.
Account takeover slips past email filters because the login is real. See the sign-in and mailbox signals worth alerting...
Phishing redirectors forward chosen victims to a hidden credential page, and AiTM kits relay your MFA. See how the...
AI code is flawed in nearly half of tested tasks, and developers are targets too. See how to train...
