{"id":2969,"date":"2026-09-18T09:31:56","date_gmt":"2026-09-18T09:31:56","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2969"},"modified":"2026-09-18T09:31:56","modified_gmt":"2026-09-18T09:31:56","slug":"claimed-bug-bounty-hunter-likely-used-llm-to-build-phantomraven-npm-stealer","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2969","title":{"rendered":"Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 18, 2026<\/span><\/span>Malware \/ Cybercrime<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven<\/strong> via the npm package registry.<\/p>\n

\u00abThe developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns,\u00bb CrowdStrike’s Counter Adversary Operations said<\/a> in an analysis published this week.<\/p>\n

PhantomRaven was first flagged by Koi Security and DCODX in late October 2025, calling attention to a slopsquatting and typosquatted campaign in which more than 100 malicious packages were uploaded to npm to steal authentication tokens, CI\/CD secrets, and GitHub credentials from developers’ machines.<\/p>\n

The software supply chain attack used these packages as a cover to retrieve a remote dynamic dependency (RDD) from an external server so that the libraries themselves are not flagged by security tools.<\/p>\n

Once installed, the malware embedded in the remote dependency scans the developer environment for email addresses, gathers information about the CI\/CD environment, collects a system fingerprint, including the public IP address, and transmits the results to an attacker-controlled server.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

It’s also equipped to collect runtime details, current date and time, username and email addresses from Git\/npm configurations, as well as CI\/CD environment variables for GitHub Actions, GitLab CI, Jenkins, and CircleCI.<\/p>\n

<\/p>\n

The latest findings from CrowdStrike show that the threat actor has been active since November 2022 and claims to be a bug bounty hunter who has collected bounties from no less than nine entities across the technology, retail, and hospitality sectors.<\/p>\n

The cybersecurity company said it has not observed information stolen from the malware appearing on stealer log shops, indicating \u00abthe operator likely uses the information stealer solely to identify bug bounty opportunities.\u00bb<\/p>\n

At least two different npm user accounts maintained by the operator have been observed pushing npm packages containing PhantomRaven. Both npm accounts are no longer accessible as of writing.<\/p>\n