Threats Tagged 'ai-assisted development'

Avalon is a sophisticated multi-stage phishing malware framework delivered via spoofed legal documents hosted on Proton Drive. It uses password-protected archives with ISO images that execute malicious MSBuild projects, loading payloads entirely in memory without traditional executables. Avalon integrates credential theft, lateral movement, recovery disruption, and ransomware functions, with its ransomware component named CrownX. The framework targets browsers, cryptocurrency wallets, messaging platforms, VPN configurations, and infrastructure systems, employing advanced defense evasion techniques. It disrupts recovery by deleting Volume Shadow Copies and Windows Recovery Environment components. The campaign demonstrates AI-assisted development, rapidly combining multiple post-exploitation capabilities. No known exploits in the wild or patches are currently documented.