New Modular Malware Framework "Avalon" Unveiled in Sophisticated Phishing Attack Cybersecurity researchers have identified a previously unknown modular malware framework, Avalon, distributed via a multi-stage phishing campaign designed to evade traditional security controls. The framework integrates credential theft, lateral movement, remote access, recovery disruption, and ransomware execution with its ransomware component internally dubbed CrownX. The attack begins with a spoofed legal document email directing recipients to a password-protected archive hosted on Proton Drive. Instead of attaching malicious files directly, attackers embedded them within an ISO image, reducing detection at the email layer. When a victim interacts with a document-themed Windows shortcut (Secure Document CA-283505.pdf.lnk) inside the mounted image, it triggers a sequence that deploys Avalon. The shortcut executes an MSBuild project within the ISO, which loads an embedded .NET assembly to disable Event Tracing for Windows (ETW), obscuring forensic visibility. The malware then downloads a next-stage payload over HTTPS to deploy Avalon, which includes an extensive defense evasion subsystem targeting security tools from Microsoft Defender, SentinelOne, CrowdStrike, Sophos, Elastic Endpoint, FortiEDR, ESET, McAfee, and Bitdefender. Avalon’s capabilities include: - Credential harvesting from Chromium-based browsers, Firefox, cryptocurrency wallets (MetaMask, Coinbase Wallet, Exodus, etc.), and apps like Discord, Slack, and Teams. - Data exfiltration to a remote server (helloxcherry[.]com) and command polling for further instructions. - Reconnaissance to prioritize high-value systems for lateral movement. - Ransomware execution using Windows Cryptography API, encrypting files tied to business operations, software development, and virtual infrastructure. - Recovery disruption by terminating the Volume Shadow Copy Service and deleting shadow copies. - Anti-forensic measures, including direct disk manipulation to corrupt partition data or boot records. Researchers note that CrownX represents only the final extortion stage by the time the ransom note appears, the framework has already stolen credentials, established C2 communications, and weakened recovery options. The malware also exhibits signs of AI-assisted development, suggesting lower barriers to entry for threat actors with limited technical expertise. ### AI-Driven Ransomware and Codeless Attacks Emerge In related developments, Sysdig reported the first publicly documented agentic ransomware attack powered by a large language model (LLM). The threat actor, JADEPUFFER, exploited CVE-2025-3248 to gain access to an exposed Langflow instance, executing an automated campaign that adapted in real-time to pivot toward a production database server for extortion. Separately, Palo Alto Networks Unit 42 uncovered an AI-powered malware combining a Telegram bot with a public LLM API (api.groq[.]com) to enable codeless attacks. The malware forwards system details to the attacker’s Telegram bot, then polls the API every five seconds to translate natural language instructions into shell commands eliminating the need for command-line expertise. The sample, uploaded to VirusTotal in March 2026, remains undetected by all engines.

Proton, known for its privacy-centric services, has introduced a feature for creating, editing, and collaborating on end-to-end encrypted documents within its storage systems, challenging the practices of tech giants like Google and Microsoft. This innovation safeguards user data from third parties, including Proton, which cannot access the content of the files. The initiative enhances user privacy, directly confronting the data collection methodologies prevalent among leading cloud service providers. As a result, there have been no reported data leaks or negative consequences following the implementation of the encrypted document feature provided by Proton.

ProtonVPN were exposed to vulnerabilities that could have allowed hackers to execute arbitrary code with administrator privileges on computers running Windows. The bugs, CVE-2018-395 were discovered by Cisco Talos security researchers which is similar to another security flaw discovered in March by security consulting firm VerSprite. ProtonVPN had released patches to fix the original vulnerability. It was still possible to execute code as an administrator albeit through a exploit. The initial vulnerability was due to OpenVPN being able to select a malicious file when choosing a VPN configuration. This could have given access to private information and hacking through arbitrary commands. They use OpenVPN's open-source software to set up secure connections from one point to another. Later versions of ProtonVPN have resolved this issue and users have been automatically prompted to update. They have not seen any evidence of this being exploited in the wild, as a user's computer needs to first be compromised by a hacker before this bug can be exploited