Executive Summary
Securonix researchers have identified a sophisticated campaign dubbed FAUX#ELEVATE targeting French-speaking corporate environments. The attack begins with phishing emails containing a VBScript file named 'nouveau_curriculum_vitae.vbs'. This dropper is notable for its extreme obfuscation, containing over 224,000 lines of junk comments (99.88% of the file) and a WMI-based 'domain-join gate' to ensure payloads are only delivered to enterprise machines.
Once active, the malware disables Windows Defender, bypasses UAC via registry modification, and deploys a toolkit for credential theft, file exfiltration, and Monero mining. The threat actor leverages legitimate infrastructure including Dropbox for hosting, compromised WordPress sites for C2 configuration, and mail.ru for SMTP-based exfiltration. The combination of anti-analysis features, living-off-the-land techniques, and a rapid 25-second execution-to-exfiltration window makes this a high-priority threat for security teams.