![\"An](\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/37\/2022\/09\/23141506\/agent-tesla-spam-mailout-letter.jpg\")
<\/a>An example of a malicious letter with Agent Tesla in attachment.<\/p><\/div>\n
From the recipient\u2019s point of view, the only red flag they can spot with the naked eye is the sender\u2019s address. Its domain name rarely matches that of the company, while the sender\u2019s name differs from the name in the signature, which isn\u2019t typical for legitimate business addresses. In the example above, the mail is sent from the \u201cnewsletter@\u201d address, which may be ok for a marketing mailout, but absolutely not normal for a letter with a request for prices for a quotation.\n<\/p>\n
What is the Agent Tesla trojan?<\/h2>\n
\nAgent Tesla, identified by our solutions as Trojan-PSW.MSIL.Agensla, is fairly old malware, which steals confidential information and sends it to the attack operators. First of all, it hunts for credentials that are stored in different programs: browsers, e-mail clients, FTP\/SCP clients, databases, remote administration tools, VPN applications, and several instant messengers. However, Agent Tesla is also capable of stealing clipboard data, recording keystrokes, and taking screenshots.<\/p>\n
Agent Tesla sends all collected information to the attackers via e-mail. However, some modifications of the malware are able to transfer data via the Telegram messenger too, or upload it to a website or FTP server.<\/p>\n
You can find additional detail about this malware and campaign, along with indicators of compromise, in this Securelist blog post<\/a>.\n<\/p>\n \nIdeally, such cyberthreats should be stopped at an early stage \u2014 when a malicious letter reaches a corporate mail server. While the naked eye can\u2019t always spot a threat at first glance, mail scanners are usually quite capable of such tasks. Therefore, it\u2019s a good idea to protect a mail server with an appropriate security solution<\/a>.<\/p>\n However, you should also think about raising the level of cybersecurity awareness among your employees; for example, by using online learning platforms<\/a>.<\/p>\nHow to stay safe<\/h2>\n