Security teams are tracking a sophisticated phishing operation codenamed FAUX#ELEVATE that disguises malware as job applications. Securonix researchers identified the campaign targeting French-speaking corporations with malicious VBScript files hidden inside fake CVs.

The initial dropper spans 9.7MB, yet only 266 lines contain actual logic. The rest consists of junk comments designed to inflate file size and evade static analysis. Upon execution, the script displays a fake error message while silently checking for domain-joined environments using Windows Management Instrumentation. This gate ensures the payload only activates on enterprise infrastructure.

Once administrative privileges are secured, the malware disables Microsoft Defender exclusions across multiple drive letters. It retrieves encrypted archives from Dropbox containing credential stealers targeting Chromium and Firefox, plus an XMRig cryptocurrency miner. The miner leverages the legitimate WinRing0x64.sys driver to maximize CPU usage.

Stolen browser data exits via mail.ru SMTP servers, while command-and-control configurations hide on compromised Moroccan WordPress sites. The entire infection chain completes in roughly 25 seconds. Post-execution, the attacker scrubs most tools to reduce forensic footprints, leaving only the miner and a persistent Trojan.

For engineering leaders, this highlights the risk of unchecked script execution within corporate networks. Attackers blend legitimate infrastructure with custom obfuscation to hijack compute resources and steal access credentials before defense mechanisms react. Protecting data pipelines requires strict controls on script execution and monitoring for unusual CPU spikes indicative of mining activity. Engineering teams must verify incoming files and restrict administrative privileges to prevent similar breaches.

Source: The Hackers News