KnowBe4 found a finance-targeted business email compromise campaign using Agent Tesla v4, delivered as a forwarded JScript attachment with emoji characters woven through the code to slip past simple string-matching defenses.
The script still runs normally, but the Unicode noise makes the malicious parts harder for signature-based tools and quick human review to spot. Once opened, the dropper launches the stealer and can collect credentials from more than 40 applications, then send them out to attacker-controlled infrastructure within seconds.
That puts the exposure at the inbox handoff: if your detections mostly look for static file patterns or obvious payloads, the user opening the attachment becomes the execution step and the resulting theft can be fast and broad.