The 25-Second Heist: Inside FAUX#ELEVATE’s “Inflated” Phishing Attack on French Corporations

Securonix researchers describe FAUX#ELEVATE, a sophisticated, targeted campaign using a malicious VBScript disguised as a resume to infect French-speaking corporate environments; the dropper uses extreme comment inflation to evade detection, performs a WMI domain-join check to target enterprise machines, employs a persistent UAC elevation loop, disables Defender, deploys ChromElevator to steal browser credentials and payment data, exfiltrates stolen profiles via smtp.mail.ru, and leaves a stealthy XMRig miner and backdoor on compromised hosts.