Top Tweets for #Agentesla
🔥 Attenzione #Malware AgenTesla in Italia
Email massiva con oggetto [Scansione] 20/11/2025 08:05.
TAR con JS che scarica #AgenTesla.
🔍 IoC:
• MD5: 236f4bacbe9af9df64f56f31c57a5e92
• URL: 192.227.135.]225/LGevNxjKu15.]bin
• C2: sslout[.]de
⚠️ Non aprite allegati sospetti.
![D3LabIT's tweet photo. 🔥 Attenzione #Malware AgenTesla in Italia
Email massiva con oggetto [Scansione] 20/11/2025 08:05.
TAR con JS che scarica #AgenTesla.
🔍 IoC:
• MD5: 236f4bacbe9af9df64f56f31c57a5e92
• URL: 192.227.135.]225/LGevNxjKu15.]bin
• C2: sslout[.]de
⚠️ Non aprite allegati sospetti. https://t.co/naLEySzPUA](https://pbs.twimg.com/media/G6MMA9lXEAAoa30.png)
#Spam #ita
#agentesla
Host:
ftp://ftp.4bagh.]net
Username:
davidNew@4bagh.]net
👇
https://t.co/pkHMM9woqO
![JAMESWT_WT's tweet photo. #Spam #ita
#agentesla
Host:
ftp://ftp.4bagh.]net
Username:
davidNew@4bagh.]net
👇
https://t.co/pkHMM9woqO https://t.co/wyIEBIP7zF](https://pbs.twimg.com/media/G2KwBXwWcAAHEze.jpg)
Cybercriminals Target Polish Businesses with Agent Tesla and Formbook Malware https://t.co/nTGdh8Lsi4
#cybercriminals #Polishbusinesses #agentesla #formbookmalware #cybercrime #cyberattacks #cybersecuritynews
lnkz[.]at link shortener domain being used to spread #agentesla
Consider chucking this link shortener domain in your blocklist within your Organizations that you work for :)
🚨 Italian users, beware!
A new malspam campaign is spreading #AgenTesla #malware!
The malicious emails, masquerading as an Italian company, urge recipients to open an attachment citing increased order prices.
#IoC
- c1f87bf4d7a84f3992df57284d4d49a5
#mwitaly
"Invio Ordine Accompagnatorio" spread #AgenTesla
IMG>bat>url>script
Samples
https://t.co/BS6dKivXaZ
#Compromised domain > @serverplan
https[:]//antuofermo[.]it/G12.txt
ExFil SMTP sslout.]de
service@cosmedicus[.de
AnyRun
https://t.co/vTE6b1U3xo
![JAMESWT_WT's tweet photo. "Invio Ordine Accompagnatorio" spread #AgenTesla
IMG>bat>url>script
Samples
https://t.co/BS6dKivXaZ
#Compromised domain > @serverplan
https[:]//antuofermo[.]it/G12.txt
ExFil SMTP sslout.]de
service@cosmedicus[.de
AnyRun
https://t.co/vTE6b1U3xo https://t.co/5ZGP7UEJHb](https://pbs.twimg.com/media/GGsgi4TWEAAu-ms.jpg)
![JAMESWT_WT's tweet photo. "Invio Ordine Accompagnatorio" spread #AgenTesla
IMG>bat>url>script
Samples
https://t.co/BS6dKivXaZ
#Compromised domain > @serverplan
https[:]//antuofermo[.]it/G12.txt
ExFil SMTP sslout.]de
service@cosmedicus[.de
AnyRun
https://t.co/vTE6b1U3xo https://t.co/5ZGP7UEJHb](https://pbs.twimg.com/media/GGsfdRgWsAAzw5K.jpg)
![JAMESWT_WT's tweet photo. "Invio Ordine Accompagnatorio" spread #AgenTesla
IMG>bat>url>script
Samples
https://t.co/BS6dKivXaZ
#Compromised domain > @serverplan
https[:]//antuofermo[.]it/G12.txt
ExFil SMTP sslout.]de
service@cosmedicus[.de
AnyRun
https://t.co/vTE6b1U3xo https://t.co/5ZGP7UEJHb](https://pbs.twimg.com/media/GGseOMUWEAERB6c.jpg)
![JAMESWT_WT's tweet photo. "Invio Ordine Accompagnatorio" spread #AgenTesla
IMG>bat>url>script
Samples
https://t.co/BS6dKivXaZ
#Compromised domain > @serverplan
https[:]//antuofermo[.]it/G12.txt
ExFil SMTP sslout.]de
service@cosmedicus[.de
AnyRun
https://t.co/vTE6b1U3xo https://t.co/5ZGP7UEJHb](https://pbs.twimg.com/media/GGseNVxWAAAzg0L.jpg)
"ordine urgente" spam email spread #AgenTesla
Attached Rar is pw protected but pw is not specify
Password is the file name 🤪
Rar
https://t.co/R0ONJOnMwM
Exe
https://t.co/K9O995hCYi
Exfil
smtp.all-tsc].com Port: 587
Username / Email To:
[email protected]
![JAMESWT_WT's tweet photo. "ordine urgente" spam email spread #AgenTesla
Attached Rar is pw protected but pw is not specify
Password is the file name 🤪
Rar
https://t.co/R0ONJOnMwM
Exe
https://t.co/K9O995hCYi
Exfil
smtp.all-tsc].com Port: 587
Username / Email To:
menshova.v@all-tsc.com https://t.co/emgBcKEG9B](https://pbs.twimg.com/media/Fw-ic0rWcAEuY6W.jpg)
![JAMESWT_WT's tweet photo. "ordine urgente" spam email spread #AgenTesla
Attached Rar is pw protected but pw is not specify
Password is the file name 🤪
Rar
https://t.co/R0ONJOnMwM
Exe
https://t.co/K9O995hCYi
Exfil
smtp.all-tsc].com Port: 587
Username / Email To:
menshova.v@all-tsc.com https://t.co/emgBcKEG9B](https://pbs.twimg.com/media/Fw-h8cAWcAA9b9k.jpg)
Campagna 🇮🇹 #Agentesla a tema "Ordine"
Oggetto: "Nuovo Ordine"
💧 Dropurl: HTTP 🇷🇴
🔥 C2: SMTP 🇸🇬
💣 Disponibili gli #IoC 👇
🔗 https://t.co/c8bucHSoEK
Telegram: https://t.co/1IAGA9cd54
"RE:Swift Payment Copy" / "RE:NEW P.ORDER"
spam mail spread #VelvetSweatshop > #AgenTesla
#CVE-2017-11882 Xlsx
https://t.co/9DSEUXJ9rL
172.245.163.[174/tup.exe
https://t.co/nUdTQ8X4uz
C2
https://api.telegram.[org/bot1830107493:AAHMNi_sDEkXwu2R5G2v8HT3myZiut3H9hI/sendMessage
1/2
"Ordine_240122" spam email
spread #AgenTesla
Img/ISO
https://t.co/01NRUNrDGN
Exe
https://t.co/jDq2d9q4LA
> FTP
ftp.hdconstruct.]ro FTPAdmin@hdconstruct[.ro
![JAMESWT_WT's tweet photo. "Ordine_240122" spam email
spread #AgenTesla
Img/ISO
https://t.co/01NRUNrDGN
Exe
https://t.co/jDq2d9q4LA
> FTP
ftp.hdconstruct.]ro FTPAdmin@hdconstruct[.ro https://t.co/XbbQL8BXsG](https://pbs.twimg.com/media/FJ27rDVXEAEKwI3.jpg)
![JAMESWT_WT's tweet photo. "Ordine_240122" spam email
spread #AgenTesla
Img/ISO
https://t.co/01NRUNrDGN
Exe
https://t.co/jDq2d9q4LA
> FTP
ftp.hdconstruct.]ro FTPAdmin@hdconstruct[.ro https://t.co/XbbQL8BXsG](https://pbs.twimg.com/media/FJ27I0XXsAAGnFl.jpg)
![JAMESWT_WT's tweet photo. "Ordine_240122" spam email
spread #AgenTesla
Img/ISO
https://t.co/01NRUNrDGN
Exe
https://t.co/jDq2d9q4LA
> FTP
ftp.hdconstruct.]ro FTPAdmin@hdconstruct[.ro https://t.co/XbbQL8BXsG](https://pbs.twimg.com/media/FJ27II7XMAItM1W.jpg)
#Malware #AgenTesla targets #Italy 🇮🇹
#malspam subject "Ordine acquisto"
md5:5B0952A0B3E5ACC544E85D52453613F9
🔥
hxxps://api.telegram.org/bot2020525866:AAFU5I3pRjBQ8AH6DaTFwmQULu8foR9ODWo
chatId: 1654428974
#infosec #security #dataprotection #cybersecurity #dataprivacy #security
Here are a few IOCs from an #agentesla #agenttesla email that I received today:
https://t.co/8sofD2qbsS
#malspam with multiple subjects
OBAVIJEST O DOSTAVI FedExa
UPOZORNĚNÍ DODÁVKY FedExA
FedEx SZÁLLÍTÁSI Értesít
FedEx TESLİMAT BİLDİRİMİ*
AVIZ DE LIVRARE FedEx
with .js attachment brings #agentesla
https://t.co/5YrT3CbRFt
C2: ftp://ftp.transdealer.cl
#cybercrime, nuova campagna #AgenTesla in #Italia a tema ordini.Falsa mail da vera azienda indiana ha documento compresso allegato con exe all’interno. Questo avvia infezione #Malware e i dati sono esfiltrati via #SMTP. #CyberSecurity #infosec @JAMESWT_MHT https://t.co/f48fiimSPd
#cybercrime, L’#Italia vittima di 32 campagne la scorsa settimana. Gli esperti di #CyberSecurity del @AgidCert: I #Malware più attivi sono stati #Urnisf/#Gozi, #AgenTesla, #Dridex e #FormBook. Proseguono #phishing/#smishing a tema #banking. #infosec https://t.co/NlfhGFdBVk
#cybercrime, the new #AgenTesla campaign passes via #Taiwan. False company emails contain ISO or zip attachment. Both hide same exe that initiates the infection of the #Malware, which communicates with an SMTP server. #CyberSecurity #infosec @JAMESWT_MHT https://t.co/aVy9yVTB2J
#cybercrime, la nuova campagna #AgenTesla passa per #Taiwan.False email di un’azienda contengono allegato iso o zip. Entrambi nascondono stesso exe che avvia infezione #Malware, il quale comunica con server SMTP #Italia #CyberSecurity #infosec @JAMESWT_MHT https://t.co/tIqxdMw9Ym
Most Popular Users
Elon Musk 
@elonmusk
241.8M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.6M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90.1M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers