PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting

Evidence record

CrowdStrike Counter Adversary Operations report on PhantomRaven, a JavaScript information stealer distributed through npm. The report describes multiple remediated incidents, the remote-URL dependency delivery path, credential and CI/CD data collection, operator attribution, and CrowdStrike's high-confidence assessment that the malware was likely developed using an LLM.

Read the original source ↗

Claim-level citations (7)

• supportsPhantomRaven used npm packages to deliver an information stealer likely developed with an LLM: CrowdStrike assessed with high confidence that PhantomRaven was likely developed using a large language model, citing verbose comments, placeholder code and statistical token-analysis patterns.

  Opening summary and Assessment sections describing the high-confidence LLM-development assessment and its indicators

• supportsPhantomRaven used npm packages to deliver an information stealer likely developed with an LLM: CrowdStrike assessed that the operator likely used compromised data to identify bug-bounty opportunities rather than selling stealer logs. Endor Labs separately reported the author's claim that the packages were intended to demonstrate supply-chain vulnerabilities for responsible disclosure or potential bug-bounty reports. Neither source establishes the operator's motive for every PhantomRaven deployment as a directly observed fact.

  Threat Actor Profile and Attribution and Assessment sections discussing absence of observed log-shop sales and likely bug-bounty use

• supportsPhantomRaven used npm packages to deliver an information stealer likely developed with an LLM: CrowdStrike Falcon Complete responded to and remediated multiple incidents involving PhantomRaven and identified two npm packages containing PhantomRaven scripts: transform-jsbi-to-bigint and sort-imports-es6-autofix.

  Threat Actor Profile and Attribution section, paragraph beginning 'CrowdStrike Falcon Complete managed detection and response'

• supportsPhantomRaven used npm packages to deliver an information stealer likely developed with an LLM: PhantomRaven collected host and developer-environment data including Git and npm configuration information and CI/CD-related environment variables that could contain authentication tokens and API keys, then exfiltrated collected data over HTTP.

  Table 2 ATT&CK mapping: Credential Access, Discovery, Collection and Exfiltration rows

• supportsPhantomRaven used npm packages to deliver an information stealer likely developed with an LLM: The PhantomRaven operator distributed malware through typosquatted npm packages that declared HTTP URL dependencies pointing to attacker-controlled infrastructure; the fetched package contained a preinstall script that executed the information stealer when installation scripts were permitted.

  Infection Vector section describing typosquatted packages, HTTP URL dependencies and preinstall execution

• supportsPhantomRaven used npm packages to deliver an information stealer likely developed with an LLM: CrowdStrike assessed with high confidence that the npm accounts jpdhellonpm1 and jpd15 were operated by the same PhantomRaven actor.

  Threat Actor Profile and Attribution, paragraphs identifying jpdhellonpm1 and jpd15 and explaining the high-confidence linkage

• contextPhantomRaven used npm packages to deliver an information stealer likely developed with an LLM: Endor Labs stated that no actual secrets or credentials appeared to have been exfiltrated in the later-wave packages it analyzed; this is a scoped finding and does not establish that no data was exfiltrated anywhere in the PhantomRaven campaign.

  Threat Actor Profile and Attribution and Technical Overview describing multiple real incidents and exfiltration behavior