Harmful Help: Analyzing a Malicious Compiled HTML Help File Delivering Agent Tesla
Summary: Unit 42 described an attack that delivered Agent Tesla through a malicious compiled HTML help file, ORDER OF CONTRACT-pdf.chm, sent inside a 7zip archive named ORDER OF CONTRACT-pdf.7z. Opening the file runs obfuscated JavaScript that launches PowerShell, which pings Google via Test-Connection, downloads further PowerShell from http://pk-consult[.]hr/N2.jpg, and loads a DLL that runs Agent Tesla in the RegAsm.exe process, exfiltrating data over FTP to ftp.videoalliance[.]ru.
What you should know: The lure was a .chm help file, a format user training rarely covers, and the final payload was Agent Tesla, known for keystroke logging, screen capturing, camera recording and theft of sensitive data sent out over FTP, SMTP or HTTP.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026