A phishing campaign is targeting French-speaking corporate environments with fake CVs that, after stealing information, deploy cryptocurrency miners. “The campaign uses VBScript files disguised as resume documents, sent via phishing emails,” stated Securonix researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee in a report shared with The Hacker News.

Once executed, the malware develops a multipurpose toolkit that combines credential theft, data exfiltration, and Monero cryptocurrency mining for maximum monetization.

The campaign, dubbed FAUX#ELEVATE by the cybersecurity firm, is notable for abusing legitimate infrastructures and services, such as Dropbox for payload storage, Moroccan WordPress…