From ZIP File to crpx0 Ransomware: Anatomy of a Multi-Stage Attack

Aryaka Threat Research Labs has discovered a campaign that shows how simple user actions can trigger complex, multi-stage malware execution chains. In this campaign, attackers lure users seeking “free OnlyFans accounts” to download a seemingly harmless ZIP file that contains the crpx0 ransomware, initiating infection and ultimately compromising the system.

Let’s understand this attack campaign through a storyline.

It Started with a “Free Account.”

It often begins with something that seems harmless. A user, curious or simply looking for a shortcut, searches for a “free OnlyFans account.” They find a link, download a ZIP file, and open it. Nothing obvious happens. No warnings, no pop-ups. But behind the scenes, everything has already begun.

The Quiet Beginning

Inside that ZIP file is a small trick, a malicious shortcut disguised as something legitimate. When the user clicks it, it quietly executes hidden commands. No flashy malware installer. No visible signs. Just a subtle chain reaction. That shortcut reaches out, downloads additional components, and sets the stage. What looked like a simple file is now the entry point to a much larger system.

The System Takes Shape

Next comes something unexpected: Python. A VBScript loader prepares the system and silently installs the components needed to run Python-based code. This is where the attack becomes more flexible. Rather than relying on a single static payload, the attackers now have a programmable environment. Once the Python script is running, it connects to a remote server. At that point, the infection is no longer static; it’s interactive. The attackers are now in control. They can send commands, update the malware, or deploy new payloads in real time. The system becomes a remote-controlled platform that adapts as needed.

Turning Access into Profit

What happens next depends on the opportunity. In many cases, the first move is quick and quiet: cryptocurrency theft. The malware monitors the clipboard, waiting for wallet addresses or recovery phrases. Swap a few characters, and funds are redirected without the user even noticing.
But it doesn’t stop there. As the attack progresses, it can expand, collecting credentials, harvesting data, and mapping the system. Eventually, it may escalate to ransomware, encrypting files while also exfiltrating sensitive information. At that point, the attacker has leverage. Pay, or lose your data and have it exposed.

Why This Works

What makes this campaign effective isn’t just the malware; it’s the structure. It’s layered and adaptable. Most importantly, it doesn’t rely on a single action. Each stage builds on the last, turning a simple download into a full compromise. There’s no obvious “attack moment.” Just a series of normal-looking steps that quietly connect.

The Bigger Picture

This is what modern threats look like. They’re no longer single-purpose tools. They’re frameworks designed to evolve, adapt, and maximize value over time. And they don’t always start inside the enterprise. A personal action, such as downloading unofficial content or clicking the wrong link, can become an entry point to something much bigger. The boundary between personal and corporate risk is thinner than it seems.

For defenders, this creates a challenge. Traditional detection methods, such as signatures and static indicators, aren’t enough. These attacks blend into normal behavior, use legitimate tools, and change as they go. To catch them, you need visibility across the entire chain:

• Execution behavior
• System changes
• Network communication

In the end, it only takes one small action to set everything in motion.

Final Thought

The attack didn’t start with malware. It started with curiosity. And that’s exactly what makes it dangerous.

Read the complete threat research report here