Back Thehackernews

Hackers Use Fake Resumes to Steal Enterprise Credentials and Deploy Crypto Miner

Thehackernews •[email protected] (The Hacker News) • March 24, 2026

An ongoing phishing campaign is targeting French-speaking corporate environments with fake resumes that lead to the deployment of cryptocurrency miners and information stealers. "The campaign uses highly obfuscated VBScript files disguised as resume/CV documents, delivered through phishing emails," Securonix researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee said in a report shared

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Uses Fake Resumes for Credential Theft and Crypto Mining A phishing campaign is targeting French-speaking corporate environments by using fake resumes to deploy malware that steals credentials and mines cryptocurrency. The attackers utilize highly obfuscated VBScript files disguised as CV documents, delivered via phishing emails. Once executed, the malware initiates a toolkit for credential theft, data exfiltration, and Monero mining. The campaign, named FAUX#ELEVATE, employs legitimate services like Dropbox and Moroccan WordPress sites for its operations. The initial VBScript triggers a fake error message to deceive users into executing it with administrative privileges. The malware can disable security controls and erase its tracks quickly, completing its attack chain in approximately 25 seconds. This campaign poses a significant risk to enterprise security due to its speed and stealth. The researchers from Securonix have identified specific email accounts used for exfiltration of stolen data. 2 sources 64

Extracted Entities

Hackers Use Fake Resumes to Steal Enterprise Credentials and Deploy Crypto Miner

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (1)

Tools (1)