Avalon is a previously undocumented modular malware framework distributed via a multi-stage phishing chain. It combines credential collection, lateral movement, remote access, recovery disruption, and ransomware execution (CrownX). It features extensive defense evasion and shows signs of AI-assisted development.