Hackers Use Fake Resumes to Steal Enterprise Credentials and Deploy Crypto Miner

This article covers the FAUX#ELEVATE phishing campaign targeting French-speaking corporate environments with fake resume files that deploy credential stealers and cryptocurrency miners.

• •The initial dropper is a heavily obfuscated VBScript (9.7MB, 224,471 lines with only 266 executable lines) disguised as a French CV document
• •The malware uses legitimate services for its infrastructure: Dropbox for payload staging, compromised Moroccan WordPress sites for C2 configuration, and mail.ru SMTP for credential exfiltration
• •A domain-join gate via WMI ensures payloads only execute on enterprise machines, skipping standalone home systems
• •Credential theft tools include a ChromElevator-based component to bypass Chromium app-bound encryption, plus VBScripts targeting Firefox and desktop files