Origin Logger: A Look at Agent Tesla’s Successor
Summary: Unit 42 analyzed OriginLogger, a keylogger variant of Agent Tesla that Agent Tesla's developers recommended on their Discord server when Agent Tesla shut down on March 4, 2019, and found little public information about it beyond Agent Tesla blogs sometimes tagged "AgentTeslav3." The researchers located two builder versions - one compiled Sept. 6, 2020 and another compiled June 29, 2022 - and traced their authentication traffic to IP 23.106.223[.]46, which has resolved to originpro[.]me since March 3, 2022, and to 74.118.138[.]76, which resolves to 0xfd3[.]com.
Bottom line: The successor to one of the most widely used criminal keyloggers has been circulating with almost no public analysis, sold through a builder whose default configuration string and plaintext-recoverable profile file make campaigns easy to cluster - and easy for buyers to operate at scale.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026