“Face mask manufacturer” supplies Agent Tesla Malware: campaign employs Covid-19 lures and sophisticated evasion techniques

This post details a sophisticated phishing campaign that leverages COVID-19 lures and the Agent Tesla malware. It describes the campaign's tactics, techniques, and procedures (TTPs), including spoofing legitimate businesses, rotating IP addresses, modifying malware hashes, and exploiting flaws in email authentication protocols (DMARC, SPF, DKIM). The post analyzes the malware's delivery mechanism via compressed executables disguised as PDFs, its information-stealing capabilities via SMTP exfiltration, and its anti-debugging and obfuscation techniques. It highlights the limitations of legacy security defenses and emphasizes the need for user awareness and advanced threat detection.