News

Security researchers from Securonix have uncovered an active phishing operation aimed at French-language corporate users that leverages counterfeit resumes to install cryptocurrency miners and information-stealing tools.

The attackers distribute highly obfuscated Visual Basic Script (VBScript) files masquerading as CV documents via spear-phishing emails. When the malicious script runs, it unpacks a multi-component toolkit designed to pilfer credentials, siphon files, and mine Monero - all intended to maximize profit for the threat operators.

Securonix has labeled the activity “FAUX#ELEVATE.” The campaign stands out for its reuse of legitimate cloud and web services: the actors store payloads on Dropbox, host command-and-control configuration on compromised WordPress sites in Morocco, and relay stolen browser credentials and desktop files through mail.ru’s SMTP infrastructure.

Rather than relying on exotic tooling, the intrusion follows a living-off-the-land approach that complicates detection. The initial stage is a VBScript dropper that, upon being opened, presents a fake error message in French to convince recipients the file is corrupted. Meanwhile, the script performs a number of sandbox-evasion checks and enters a persistent User Account Control (UAC) loop that repeatedly prompts the user to grant administrative privileges.

Remarkably, the malicious VBScript contains 224,471 lines but only 266 lines are meaningful code; the remainder consists of filler comments with random English sentences that bloat the file to roughly 9.7MB. The dropper also implements a domain-join gate using Windows Management Instrumentation (WMI), making sure full payloads are delivered exclusively to domain-joined enterprise machines while skipping standalone home systems.

Once it secures admin rights, the dropper moves fast to neutralize defenses and hide its activity. It configures Microsoft Defender exclusion rules for drive letters C: through I:, disables UAC via a registry modification, and then removes the initial dropper file.

The script then downloads two password-protected 7-Zip archives hosted on Dropbox: “gmail2.7z” (containing various executable components for data theft and mining) and “gmail_ma.7z” (including utilities responsible for persistence and post-infection cleanup).

Key components in the toolkit include a module that adapts the ChromElevator project to extract secrets from Chromium-based browsers by circumventing app-bound encryption (ABE). Other notable elements are:

• mozilla.vbs: a VBScript designed to harvest Firefox profiles and stored credentials.
• walls.vbs: a VBScript used to collect and exfiltrate files from the desktop.
• mservice.exe: an XMRig-based Monero miner that starts after pulling its mining configuration from a compromised Moroccan WordPress site.
• WinRing0x64.sys: a legitimate Windows kernel driver abused to unlock higher CPU mining performance.
• RuntimeHost.exe: a persistent Trojan component that alters Windows Firewall rules and periodically contacts a command-and-control server.

Stolen browser data is exfiltrated via two mail[.]ru accounts - olga.aitsaid@mail[.]ru and 3pw5nd9neeyn@mail[.]ru - which reportedly use the same password to forward harvested credentials over SMTP to an address controlled by the actor, vladimirprolitovitch@duck[.]com.

After the theft and exfiltration phases conclude, the attackers run an aggressive cleanup routine to remove most of the dropped tools and reduce forensic traces, typically leaving only the miner and select trojan artifacts behind.

According to Securonix, FAUX#ELEVATE is a coordinated, multi-stage intrusion that blends several advanced techniques into a compact infection chain. What makes it particularly hazardous for enterprise defenders is its speed and selectivity: the researchers observed the full chain - from VBScript execution to credential exfiltration - completing in about 25 seconds, and the domain-join checks ensure each compromised host yields valuable corporate credentials and persistent compute resources for illicit mining.