Fake resumes: the latest front for credential theft and crypto-mining

A simple CV can trigger data theft and covert exploitation of corporate systems in seconds

A phishing campaign is targeting French-speaking corporate environments with fake CVs that, after stealing information, deploy cryptocurrency miners. "The campaign uses VBScript files disguised as resume documents, sent via phishing emails," stated Securonix researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee in a report shared with The Hacker News .

Once executed, the malware develops a multipurpose toolkit that combines credential theft, data exfiltration, and Monero cryptocurrency mining for maximum monetization .

The campaign, dubbed FAUX#ELEVATE by the cybersecurity firm, is notable for abusing legitimate infrastructures and services, such as Dropbox for payload storage, Moroccan WordPress sites for hosting command and control (C2) configuration, and mail[.]ru's SMTP infrastructure for exfiltrating desktop files and stolen browser credentials.

The initial file is a Visual Basic Script (VBScript) that, when opened, displays a fake error message in French, tricking recipients into thinking the file is corrupted. However, what happens is that the script executes a series of checks to evade testing environments and enters a persistent User Account Control (UAC) loop, prompting users to run it with administrator privileges.

Out of the 224,471 lines of the script, only 266 contain actual executable code. The rest is filled with junk with random phrases in English, inflating the file size to 9.7 MB.

"The malware also uses a domain-joining filter via WMI (Windows Management Instrumentation), ensuring that the payloads are only delivered on enterprise computers, completely excluding standalone systems," the researchers stated.

As soon as the dropper gains administrative privileges, it disables security controls and erases its tracks: it sets exclusion paths in Microsoft Defender for all main drive letters (from C to I), disables UAC via a change in the Windows Registry, and deletes itself.

Among the tools used to facilitate credential theft is a component that leverages the ChromElevator project to extract sensitive data from Chromium-based browsers, bypassing application-bound encryption protections (ABE).

Browser data is exfiltrated using two separate mail[.]ru sender accounts ("olga.aitsaid@mail.ru" and "[email protected]") that the same password via SMTP to another email address operated by the attacker ("vladimirprolitovitch@duck.com").

Once the theft and exfiltration activities are executed, the attack chain initiates an aggressive cleanup of all downloaded tools in an attempt to minimize the forensic footprint, leaving behind only the miner and trojan artifacts.

This campaign is particularly dangerous for security teams due to its execution speed : the entire chain is completed in approximately 25 seconds from the initial execution of the VBS to exfiltration.

A phishing campaign is targeting French-speaking corporate environments with fake CVs that, after stealing information, deploy cryptocurrency miners. "The campaign uses VBScript files disguised as resume documents, sent via phishing emails," stated Securonix researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee in a report shared with The Hacker News .

Once executed, the malware develops a multipurpose toolkit that combines credential theft, data exfiltration, and Monero cryptocurrency mining for maximum monetization .

The campaign, dubbed FAUX#ELEVATE by the cybersecurity firm, is notable for abusing legitimate infrastructures and services, such as Dropbox for payload storage, Moroccan WordPress sites for hosting command and control (C2) configuration, and mail[.]ru's SMTP infrastructure for exfiltrating desktop files and stolen browser credentials.

The initial file is a Visual Basic Script (VBScript) that, when opened, displays a fake error message in French, tricking recipients into thinking the file is corrupted. However, what happens is that the script executes a series of checks to evade testing environments and enters a persistent User Account Control (UAC) loop, prompting users to run it with administrator privileges.

Out of the 224,471 lines of the script, only 266 contain actual executable code. The rest is filled with junk with random phrases in English, inflating the file size to 9.7 MB.

"The malware also uses a domain-joining filter via WMI (Windows Management Instrumentation), ensuring that the payloads are only delivered on enterprise computers, completely excluding standalone systems," the researchers stated.

As soon as the dropper gains administrative privileges, it disables security controls and erases its tracks: it sets exclusion paths in Microsoft Defender for all main drive letters (from C to I), disables UAC via a change in the Windows Registry, and deletes itself.

Among the tools used to facilitate credential theft is a component that leverages the ChromElevator project to extract sensitive data from Chromium-based browsers, bypassing application-bound encryption protections (ABE).

Browser data is exfiltrated using two separate mail[.]ru sender accounts ("olga.aitsaid@mail.ru" and "[email protected]") that the same password via SMTP to another email address operated by the attacker ("vladimirprolitovitch@duck.com").

Once the theft and exfiltration activities are executed, the attack chain initiates an aggressive cleanup of all downloaded tools in an attempt to minimize the forensic footprint, leaving behind only the miner and trojan artifacts.

This campaign is particularly dangerous for security teams due to its execution speed : the entire chain is completed in approximately 25 seconds from the initial execution of the VBS to exfiltration.

Become a premium member for free!