Agent Tesla is a .NET-based spyware and keylogger used to steal credentials, capture keystrokes, and collect data from infected Windows systems. Attackers typically deliver it through phishing attachments or malicious downloads. Defenders should look for suspicious outbound email, credential theft alerts, and processes that access browser, mail, or clipboard data.
What Agent Tesla Does Beyond Basic Credential Theft
Agent Tesla is more than a simple password stealer: it sits in memory, watches user activity, and can exfiltrate whatever it captures from an infected Windows host. That makes it dangerous wherever credentials, email content, browser data, or clipboard contents can reveal wider access paths.
How Agent Tesla Commonly Gets In And What It Harvests
Its delivery usually depends on social engineering, especially phishing attachments and malicious downloads, so initial compromise often looks like a routine user mistake rather than a noisy exploit. Once executed, it is designed to collect high-value identity material such as logins, sessions, and other data that can be reused for follow-on intrusion.
That reuse risk is why credential theft is rarely the end of the story: captured access can be replayed into mailboxes, SaaS platforms, VPNs, or internal systems if organisations have not reduced standing access and added resilient detection. For defenders, the relevant question is not only whether malware ran, but whether the stolen material can still be used elsewhere.
What To Look For On An Infected Windows System
Agent Tesla often leaves behavioural clues rather than obvious file names. Suspicious outbound email, unusual process access to browser storage or mail clients, clipboard scraping, and unexpected authentication alerts are all consistent with its collection logic.
Because the malware targets information already present on the endpoint, post-compromise review should focus on what the host could reveal to an attacker: saved browser credentials, active mail sessions, cached tokens, and any secrets exposed in local files or copied text. If those items were present, assume the attacker may have used them or attempted to.
Why This Malware Matters For Exposure And Containment
Agent Tesla is dangerous because it turns a single compromised workstation into a source of reusable access. If the victim machine belongs to a user with broad email, cloud, or administrative reach, the theft can quickly become an enterprise access problem rather than an endpoint-only incident.
Containment is therefore as much about access reduction as malware removal. The infected host should be isolated, relevant credentials and sessions should be invalidated, and adjacent accounts should be checked for suspicious use that may have followed the theft.
Risk and Threat Considerations
Agent Tesla is often used as a first-stage access stealer, which means its main risk is not the malware sample itself but the downstream reuse of stolen credentials and session material. That can enable mailbox takeover, business email compromise, and lateral movement if the harvested data still works after the endpoint is cleaned.
Failure mechanism: The malware captures authentication material from the endpoint and sends it to the attacker, who can then test it against email, cloud, or internal services before the victim notices.
Impact: A single infected Windows host can become a launch point for account takeover, data theft, and broader compromise of trusted business systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1056.001 — Keylogging | Agent Tesla’s keystroke capture maps directly to keylogging behaviour. |
| T1114 — Email Collection | The malware’s email-focused collection and suspicious outbound email fit mailbox-access abuse. | |
| Recommendation — Detect keylogging activity and investigate processes that capture keystrokes from user input streams. Monitor mailbox access patterns and review email collection indicators after suspected compromise. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Delivery via phishing attachments and browser-targeted credential theft fits email and browser hardening. |
| Recommendation — Harden email and browser controls to reduce phishing delivery and credential harvesting exposure. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Detection depends on reviewing authentication, process, and exfiltration telemetry for suspicious activity. |
| Recommendation — Correlate endpoint, email, and authentication logs to identify credential-theft behaviour quickly. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Agent Tesla steals credentials and other secret material from compromised endpoints. |
| Recommendation — Protect and rotate exposed secrets immediately after any suspected endpoint credential theft. | ||
Practitioner Guidance
Why practitioners should care: Treat a confirmed Agent Tesla infection as both a malware incident and an identity incident. Cleaning the host without rotating exposed credentials or ending active sessions can leave the attacker with a still-valid path back in.
What to watch for: Prioritise the accounts used on the infected system, especially email, browser-saved logins, and any privileged or remote-access credentials that may have been accessible from that workstation.
Practitioner takeaway: The most important control decision is often whether stolen credentials can still authenticate anywhere, not whether the endpoint is now free of the malware.