Fake Resume Scam Targets Businesses with Crypto Miners

Michael Miller · 2026-03-24

Here's something that should make every hiring manager and IT professional pause. There's a new, sophisticated phishing campaign making the rounds, and it's using something we all see every day: resumes. It's not just any spam. This one specifically targets French-speaking corporate environments with fake CVs that are actually malicious scripts in disguise. The end goal? Stealing your company's credentials and secretly installing cryptocurrency mining software on your network. ### How the Fake Resume Scam Works The attack is surprisingly simple in its delivery, which is what makes it so dangerous. It starts with a phishing email that looks legitimate enough to pass a quick glance. The email contains an attachment—what appears to be a resume or CV document. But here's the catch. That document isn't a PDF or a Word file. It's a highly obfuscated VBScript file. For those not in the tech weeds, VBScript is a type of scripting language that can automate tasks on Windows systems. In the wrong hands, it's a powerful tool for attackers. Securonix researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee detailed the campaign in a recent report. They noted, "The campaign uses highly obfuscated VBScript files disguised as resume/CV documents, delivered through phishing emails." The obfuscation is key. It scrambles the code to make it harder for security software to detect the malicious intent. To an automated scanner, it might just look like a messy text file. To a human resources employee expecting a job application, it looks like a corrupted document. ### The Double Threat: Stealers and Miners Once someone in your organization opens that fake resume, the script executes. It doesn't just do one thing—it unleashes a two-pronged attack that hits both your data and your hardware. First, it deploys an information stealer. This malware is designed to quietly rummage through the infected computer and network, looking for valuable login credentials. We're talking about: - Corporate email passwords - Database access keys - Financial system logins - Virtual Private Network (VPN) credentials Second, and almost simultaneously, it installs a cryptocurrency miner. This software hijacks your company's computing power—your processors and graphics cards—to solve complex math problems that generate cryptocurrency for the attacker. You might not notice it immediately. The miner often runs in the background, slowing down systems and driving up electricity costs while generating digital cash for someone halfway around the world. ### Why This Attack Is So Effective Think about your own workplace for a second. How many resumes does your HR department receive in a week? Dozens? Hundreds? The volume alone makes it hard to scrutinize every attachment. This attack exploits that very human reality. We're conditioned to open resumes. It's part of the job. The attackers are betting on that automatic response, coupled with the fact that many corporate email filters are tuned to look for different types of threats. A resume attachment doesn't typically trigger the same alarms as an invoice with macros or a shipping notification with a suspicious link. It flies under the radar precisely because it seems so mundane. ### What You Can Do Right Now Don't panic, but do take action. Here are some practical steps to protect your organization: - **Train your team, especially HR.** Make sure everyone knows that even seemingly harmless attachments can be dangerous. Teach them to verify the sender before opening anything unexpected. - **Implement technical safeguards.** Configure your email security to treat all script files (.vbs, .js, .ps1) as high-risk, regardless of their disguise. Consider sandboxing attachments so they open in isolated environments. - **Monitor for unusual activity.** Keep an eye on your systems for signs of cryptocurrency mining: sudden spikes in CPU/GPU usage, increased fan noise from computers, or unexplained spikes in your electric bill. - **Use application whitelisting.** This approach only allows approved programs to run on company machines, blocking unauthorized scripts entirely. ### The Bigger Picture This campaign targeting French-speaking businesses is part of a worrying trend. Attackers are getting more creative with their lures, moving beyond the obvious scams to exploit everyday business processes. The fake resume is just the latest example. As one security professional put it recently, "The most dangerous threats are the ones that look like Tuesday." This attack doesn't come with flashing warnings or obvious red flags. It looks like work. And that's exactly why it works. The takeaway is clear: in today's digital landscape, vigilance needs to extend to every corner of your business operations, even the hiring process. Because sometimes, the biggest threats come disguised as opportunity.