An active phishing campaign tracked as FAUX#ELEVATE is targeting French-speaking corporate environments by distributing malware disguised as resume documents. Within approximately 25 seconds of opening the file, the malware steals browser-stored credentials and exfiltrates them before silently installing a cryptocurrency miner, all while evading detection through Dropbox staging and compromised WordPress infrastructure. Organizations with French-speaking employees, domain-joined Windows environments, or Chromium-based browser deployments face direct exposure to credential compromise and unauthorized resource consumption.