activegrp.co.za: a website listed for picture files that hide Remcos and Agent Tesla, and what to do if a loader fetched them

What activegrp.co.za is, and what we know about it

activegrp.co.za is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware files were served, hidden inside PNG pictures. It is also an ordinary looking website: our server got a normal page back. We found no public write-up of this address, so what follows is what URLhaus shows, what our one plain request showed, and what MITRE and Microsoft have published about the technique and the two malware families named in the tags.

1. 1

   What URLhaus lists

   Three file addresses on activegrp.co.za, all named img_ followed by six digits with the ending .png, all on the main secure address of the site. Two were added on 24 September 2026 within one second of each other (img_075144.png and img_095713.png) and one on 12 October 2026 (img_160619.png). All three carry the threat label malware_download and the reporter is abuse_ch.

2. 2

   What the tags mean

   stego is short for steganography: data hidden inside another file, here inside a picture. AgentTesla is the name of a spyware trojan for Windows that steals what you type and the passwords saved on the PC. RemcosRAT names Remcos, a remote control tool that criminals use to take over a PC; rat means remote access trojan. The two September files are tagged AgentTesla and stego. The October file is tagged rat, RemcosRAT and stego.

3. 3

   What is online and what is not

   When we read our copy of the data on 12 October 2026, the October file was marked online and the two September files were marked offline. Offline means URLhaus no longer got the file from the address at its last check. It does not mean the files were harmless, and it does not say when they were taken down.

4. 4

   What we could not confirm

   We did not download any of the pictures, so we cannot tell you what is inside them, which build of the malware they carry or where it reports to. URLhaus shows the tags, not a proof. We also do not know how the files got onto this website, and we do not know which program or message makes a victim's PC ask for them. That first step is not visible from the server side.

5. 5

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a PC where something already ran and went to fetch one of these pictures. A normal visitor has no reason to ask for files named like this.

Kind of threat

A website that was reported as a source of PNG files tagged stego; two are tagged AgentTesla and one RemcosRAT, both trojans for Windows

Where the files are

hxxps://activegrp[.]co[.]za/img_NNNNNN.png: files in the top folder of the site, over the normal secure address

Domain registration

Not known. Our registration lookup (RDAP) returned no record for this .co.za domain on 12 October 2026, so we cannot give a date or a registrar

URLhaus entries

3 file addresses, added 24 September (2) and 12 October 2026 (1); 1 online and 2 offline in our copy of the data

Delivery trick

Steganography: code hidden in picture files so a download looks like an image. The entry step on the victim's PC is not known

Platform

Windows. MITRE describes both Remcos and Agent Tesla as Windows tools. Nothing we read says these pictures affect Mac, iPhone or Android

What we checked on 12 October 2026, and what we could not

Our check was one plain request to the home page from our server, with no browser, no clicks and no second visit. It was answered normally. That clears nothing: it says only that the front page of the site was not obviously broken at that moment, and the reported files are separate addresses.

What happened to activegrp.co.za, from the first report to our check

The reports span less than three weeks. The dates come from the URLhaus data we hold; the times are UTC.

1. 24 September 2026

   Two picture files are reported as Agent Tesla carriers

   At about 06:35 UTC abuse.ch adds img_075144.png and img_095713.png within one second. Both are tagged AgentTesla and stego. In our copy of the data both are now marked offline.

2. 24 September to 12 October 2026

   Eighteen days with no new report

   Our data shows nothing added in between. We cannot say whether the address was quiet, whether the files stayed up for a while, or whether nobody looked.

3. 12 October 2026

   A third file, tagged Remcos, and our check

   At about 08:18 UTC img_160619.png is added with the tags rat, RemcosRAT and stego and the status online. A different family than in September, from the same website and with the same file naming. Our own plain request to the home page later the same day is answered normally.

   

What the pattern suggests, and what it does not: files with the same naming scheme, a switch from one malware family to another, and a new file after more than two weeks. That looks like someone who keeps a place to host picture files and swaps the content. It is our reading of the dates, not something any report says.

How a picture file can carry a trojan

A picture that hides code cannot hurt you by being opened or looked at. It works only when a loader that is already running reads the hidden part and starts it. We did not see the files on activegrp.co.za; this is how MITRE describes the technique in general.

1. 1

   A first program is already running

   Something has to start the chain: a script, a document or a program that the person opened. MITRE lists spearphishing emails with malicious documents, including Excel files, as the delivery route for Remcos, and spearphishing emails with attachments as the main route for Agent Tesla.

2. 2

   It fetches a picture

   The loader asks a web address for a file ending in .png. To a network filter that only looks at file type, the answer is an ordinary image. MITRE's page on this technique says adversaries hide information inside images, audio, video or text files to avoid detection, and gives a PNG used to hide PowerShell commands as an example.

3. 3

   The hidden part is a program or a script

   The loader reads the hidden bytes out of the picture, decodes them and runs them. MITRE lists other cases of executables hidden in PNG and BMP files and of binaries in encrypted PNG files. Which of these methods the files on activegrp.co.za use is not known.

4. 4

   It runs inside a trusted process or alone

   Both families are described as hiding. MITRE says Remcos uses process injection, and says Agent Tesla uses process hollowing and process injection and can drop RegAsm.exe, a genuine Windows program, to do its work. In Task Manager the process can then carry a trusted name.

5. 5

   The trojan connects to its controller

   From then on a person elsewhere receives what the trojan collects. The next sections list what the sources say each family does.

MITRE says this technique cannot easily be prevented with controls, because it abuses ordinary features of files. That is why the useful defences are earlier (do not run the first program) and later (notice the trojan and its connection).

What Remcos is

Remcos is sold as remote control software and used by criminals as a remote access trojan. It is the family named in the newest report.

What Agent Tesla is

Agent Tesla is a spyware trojan written for the .NET framework. It is the family named in the two September reports, which are now offline.

What these trojans can take from a Windows PC

Both families give a person a window into your computer, so the list below is what such a person can collect rather than what every build does automatically. Each item is named by at least one source; no single build does all of it.

What this can cost you

Reading about the site or seeing its name costs nothing. The risks below apply to a Windows PC where a loader fetched one of these pictures and a trojan then ran.

• High

  Passwords and accounts

  A keylogger records what you type into every site, including the new passwords you set. Changing passwords on the infected PC does not help; whoever receives the data sees the new ones too.

• High

  Email and work logins

  Agent Tesla is described as sending stolen data by email, FTP or HTTP, and as taking credentials from browsers and FTP clients. A stolen mailbox opens the reset path for most of your other accounts.

• High

  Someone using your PC live

  Remcos accepts commands. The controller can come back, watch the screen, open the camera or microphone and run programs while you are logged in.

• Medium

  Your files and your camera

  MITRE lists file search, archive and upload for Remcos and webcam capture for both. Private documents and images on the PC are exposed.

• Medium

  More malware on the same PC

  MITRE says Agent Tesla can download additional files. A PC reached by one loader is a PC that can be handed further payloads.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Spyware and remote access trojans are built to be quiet. The signs below come from the sources and from what they imply; none is certain and many victims notice nothing.

How a person ends up asking for these pictures

Nobody visits img_160619.png on purpose. The request comes from a program, so the real question is how that program got on the PC. We cannot say for this website; the routes below are the ones MITRE lists for the two families.

1. 1

   An email attachment that wants you to open it or allow content

   MITRE lists spearphishing emails with malicious documents, including Excel files, for Remcos, and spearphishing emails with malicious attachments for Agent Tesla. Opening the file and clicking to enable content or to open an embedded item is what starts the chain.

2. 2

   An old Office flaw on an unpatched PC

   MITRE names CVE-2017-11882 and CVE-2017-8570 as flaws Agent Tesla has been delivered through. An up to date Office and Windows closes those two routes.

3. 3

   A second-stage fetch by something already on the PC

   MITRE says Agent Tesla can download additional files. A PC that already carries a loader or another trojan can be told to fetch more from an address like this one.

If you own or manage activegrp.co.za

The home page looks like a normal small company site. If it is yours, the picture files may be there without your knowledge. This section is our own advice, not a procedure from a vendor, and we cannot see your server.

1. 1

   Look for files you did not upload

   Open your hosting file manager or an FTP client and look in the top folder of the site for files named img_ followed by six digits and .png. The reported addresses sit directly under the domain. Note the dates the files were changed, but do not open them on your own PC; copy them for your host or a security contact if you want them examined.

2. 2

   Remove the files and find how they got there

   Delete the files only after you have kept a copy and a note of the change times. A file you did not upload means someone had write access: a stolen hosting or FTP password, a weak admin login, or an outdated plugin or builder. Your hosting provider's logs may show which.

3. 3

   Change every login that touches the site

   Change the hosting panel, FTP, website builder and email passwords from a clean device, turn on two step sign in where it is offered, and remove accounts that you do not recognise.

4. 4

   Tell your host and ask for a review

   Tell your hosting provider what you found. After you have cleaned up, the abuse.ch project behind URLhaus lets site owners ask for a listing to be reviewed; we did not read the current procedure, so check it on abuse.ch itself.

5. 5

   Do not assume the cleanup is complete

   If the files came back after you deleted them, something else on the server is still writing them. A full restore from a backup made before the first date, 24 September 2026, with new passwords, is safer than hunting for single files.

Check your PC before you delete anything

Start with the question that matters: did something on this PC contact activegrp.co.za, or did you open an unexpected Office attachment, script or installer? If you saw the name in a firewall or DNS log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. Both families need a connection to send what they collect or to receive commands.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for a detection called Remcos, Trojan:Win32/Remcos, Agent Tesla or anything blocked or quarantined around the time of first contact. A removed item still means the file arrived.

4. 4

   Look at Startup apps

   Open Settings > Apps > Startup and look for names you did not install. MITRE lists a Run key value and Startup folder entries as the places these families use. Write down a name you do not know; do not delete yet.

5. 5

   Open Task Scheduler

   Press Start, type Task Scheduler and open it. In Task Scheduler Library, look for tasks with random names or that run a script or a program from a user folder. MITRE lists scheduled tasks for Agent Tesla. Note the name and the program it runs.

6. 6

   Look at running processes

   Open Task Manager and the Processes tab. Sort by Network and look for RegAsm.exe running with no reason, or any unknown process with steady network use. A genuine Windows file name is not proof of innocence and a missing one does not clear the PC.

7. 7

   Check Defender exclusions

   In Windows Security > Virus & threat protection > Manage settings > Exclusions, look for folders you did not add. We found no source saying these two families add exclusions, so a clean list does not clear the PC.

8. 8

   Check your accounts from another device

   Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check.

9. 9

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a clean site test: one data point. We did not infect a PC with these files, so the order of the plan is our judgement from Microsoft's and MITRE's pages, not a tested result.

If you use a Mac, an iPhone or an Android phone

The tags and every source we read describe Windows threats. We found nothing that says the pictures on activegrp.co.za affect anything else.