New Avalon Malware Framework Packs CrownX Ransomware Capabilities

A surge of high-impact activity: researchers uncovered Avalon, a modular malware framework that delivers credential theft, lateral movement and CrownX ransomware via multi-stage phishing; North Korea-linked malicious npm packages impersonating Rollup polyfills to steal developer secrets; targeted campaigns (Armored Likho, ToddyCat/Umbrij, VEIL#DROP, PamStealer, ChocoPoC) delivering stealers, RATs and API-based email exfiltration; and mass credential theft (FortiBleed) tied to ransomware groups. Multiple high-severity vulnerabilities are in active use or being added to KEV — notably SharePointR