Vibe Coded Extortion: Path from Legal Lure to CrownX Ransom Capabilities

A sophisticated multi-stage phishing campaign delivers a previously undocumented framework called Avalon through spoofed legal documents hosted on Proton Drive. The intrusion begins with password-protected archives containing ISO images that execute malicious MSBuild projects, loading payloads entirely in memory without conventional executable attachments. Avalon consolidates credential theft, lateral movement, recovery disruption, and ransomware capabilities within a single framework, with its encryption component branded as CrownX. The framework demonstrates hallmarks of AI-assisted development, rapidly combining multiple post-exploitation capabilities that previously required sustained development effort. Avalon targets browsers, cryptocurrency wallets, messaging platforms, VPN configurations, and infrastructure systems while implementing extensive defense evasion techniques against major security products. The framework disrupts recovery by eliminating Volume Shadow Copies, Windows Recovery Environment...

• Citrus Ransomware: tactics, techniques, procedures, and links to Toy GhoulsMalware2026-11-11
• Grand Theft Auto VI Release Phishing LuresMalware2026-11-05
• ARTEX and beyond: AI-enabled penetration testing platformsAnalysis2026-11-13
• [INCIDENT REPORT] Suspected Fantom Ransomware Compromise — Investigating Potential Links to Monday @ HH (HackHound)Malware2026-11-09
• How AI Revived a Stalled Attack on a U.S. RetailerMalware2026-11-12