H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Agent Tesla](https://attack.mitre.org/software/S0331) is a spyware Trojan written for the .NET framework that has been observed since at least 2014.(Citation: Fortinet Agent Tesla April 2018)(Citation: Bitdefender Agent Tesla April 2020)(Citation: Malwarebytes Agent Tesla April 2020)

Labels

malware

39 recorded

Relationships

uses

to Archive Collected Data

Technique

uses

to Browser Session Hijacking

Technique

uses

to Clipboard Data

Technique

uses

to Credentials from Password Stores

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Credentials In Files

Technique

uses

to Credentials in Registry

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Hidden Files and Directories

Technique

uses

to Hidden Window

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Local Account

Technique

uses

to Mail Protocols

Technique

uses

to Malicious File

Technique

uses

to Modify Registry

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Process Hollowing

Technique

uses

to Process Injection

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Regsvcs/Regasm

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to Spearphishing Attachment

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Video Capture

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Web Protocols

Technique

uses

to Wi-Fi Discovery

Technique

uses

to Windows Management Instrumentation

Technique

uses

from SilverTerrier

Group

uses

Group

7 external

References

mitre-attack

S0331

Agent Tesla

—

Bitdefender Agent Tesla April 2020

https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/

Talos Agent Tesla Oct 2018

https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new-rtf_15.html

Malwarebytes Agent Tesla April 2020

https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/

DigiTrust Agent Tesla Jan 2017

https://www.digitrustgroup.com/agent-tesla-keylogger/

Fortinet Agent Tesla April 2018

https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html