Loading story…
Securonix reported an ongoing phishing campaign dubbed FAUX#ELEVATE that targets French-speaking corporate environments with fake resume lures, including a VBScript file named nouveau_curriculum_vitae.vbs. The heavily obfuscated dropper shows a fake French error message, checks whether the victim is on a domain-joined enterprise machine, and pushes the user to grant administrator privileges before continuing. Once elevated, the malware disables security controls, downloads password-protected payloads from Dropbox, steals credentials from Firefox and Chromium-based browsers, collects desktop files, and exfiltrates data through smtp.mail.ru:465 using victim country-code tagging.
The intrusion chain also deploys a persistent remote access trojan and XMRig-based Monero mining components, with persistence established through Registry Run keys and a hidden scheduled task. Researchers said the RAT injects into explorer.exe, while command-and-control, mining configuration, and staging rely on compromised Moroccan WordPress sites, OVH-hosted infrastructure, a Swedish VPN provider, and legitimate tools such as 7-Zip and a signed kernel driver to blend in with normal traffic. Securonix assessed the operation as a financially motivated cybercrime campaign that rapidly completes its infection flow, cleans up artifacts, and monetizes enterprise access through both credential theft and cryptomining.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-24, Securonix published research detailing the FAUX#ELEVATE campaign, its fake resume lure, enterprise-focused execution checks, credential theft, RAT activity, and cryptomining components. The company assessed it as an ongoing, financially motivated cybercrime operation likely run by a small operator or team.
During the campaign, victims who opened the fake resume file were led through a heavily obfuscated VBScript infection chain that sought administrator privileges, disabled security controls, stole browser and Firefox credentials, exfiltrated files via mail.ru SMTP, established persistence, and deployed XMRig Monero miners. The operation also used Dropbox for staged payload delivery and compromised Moroccan WordPress sites plus other infrastructure for command-and-control and configuration retrieval.
Securonix said the FAUX#ELEVATE operation was active during 2025, using phishing emails with fake CV-themed VBScript attachments to target French-speaking corporate environments. The campaign selectively executed on domain-joined enterprise machines, indicating deliberate targeting of business victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 45 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs reported that the financially motivated **REF1695** operation has used counterfeit software installers since November 2023 to infect victims with remote access trojans and cryptocurrency miners. Recent activity relied on fake **ISO** files containing a .NET Reactor-protected loader and a text file that led to deployment of a previously undocumented **.NET implant** called **CNB Bot**, which can inject additional payloads. The infection chain instructed users to bypass Microsoft Defender SmartScreen, then used PowerShell to add broad Microsoft Defender Antivirus exclusions, launch malware, and display a fake application error to mask the compromise. Researchers linked the same actor to campaigns delivering **PureRAT**, **PureMiner**, a custom .NET-based **XMRig** loader, and **SilentCryptoMiner**, with some payloads abusing the vulnerable signed drivers `WinRing0x64.sys` and `Winring0.sys` to tune CPU settings and improve mining performance. The operation also used watchdog functions and scheduled tasks for persistence and recovery, communicated with command-and-control servers over HTTP POST, and abused **GitHub** as a trusted platform for staged payload delivery to reduce detection. Elastic estimated the campaign generated **27.88 XMR** across four tracked wallets, worth about **$9,392**.
Jun 29, 2026
Kaspersky reported that the open-source **XMRig** Monero miner was being folded into broader malware operations, including a "ransominer" chain that monetized victims before any ransom was paid. In one observed intrusion, attackers used a generic Trojan to install administrative tools, create a new user account, enable **RDP** access, deploy **Trojan-Ransom.Win32.Crusis**, and then launch an XMRig loader so the compromised host immediately began generating cryptocurrency for the attackers. Telemetry showed more than **5,000** attempts in August 2020 to install XMRig or modified variants, with **Prometei** and **Cliptomaner** identified as major distributors. Prometei brute-forced **MS SQL** credentials, abused `xp_cmdshell` and **`CVE-2016-0099`**, and used a cross-platform **.NET Core/Apphost** loader to fetch miner payloads for Windows and Linux systems. Cliptomaner, first detected in September 2020, posed as **Realtek** audio software, was written in **AutoIT**, mined cryptocurrency, and also hijacked copied wallet addresses by replacing them with attacker-controlled ones.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026