Vibe Coded Extortion: Path from Legal Lure to CrownX Ransom Capabilities

Reported 02 Jul 2026 by otx · Severity: medium

A sophisticated multi-stage phishing campaign delivers a previously undocumented framework called Avalon through spoofed legal documents hosted on Proton Drive. The intrusion begins with password-protected archives containing ISO images that execute malicious MSBuild projects, lo