CrowdStrike links PhantomRaven malware to bug bounty hunter

CrowdStrike has identified a bug bounty hunter it says developed and distributed the PhantomRaven information stealer through npm. It believes the malware was likely generated with a large language model.

The report describes a financially motivated actor that appears to have used typosquatted npm packages to deliver JavaScript-based malware to developers. The operator then allegedly used compromised access and stolen information to pursue bug bounty payouts through recognised disclosure platforms, rather than sell stolen data on criminal marketplaces.

According to the report, the actor has been active as a self-described bug bounty hunter since November 2022 and has claimed rewards from at least nine companies in the technology, retail and hospitality sectors. Public online profiles tied to the individual referenced platforms including Bugcrowd, Intigriti, YesWeHack, HackenProof and HackerOne.

The case stands out because the actor appears to have built bespoke malware instead of relying on rented tools or widely available stealers. CrowdStrike said it had not observed PhantomRaven logs being offered for sale, leading it to conclude the malware was used mainly to identify and exploit opportunities that could later be reported through bug bounty channels.

How it spread

Investigators said the malware was distributed through npm packages with names designed to resemble legitimate developer tools. Two packages highlighted in the report were transform-jsbi-to-bigint and sort-imports-es6-autofix, published under the npm usernames jpdhellonpm1 and jpd15.

The packages appeared harmless on the surface and contained only minimal code, often a basic script. The malicious element was hidden in a dependency fetched over HTTP from infrastructure controlled by the attacker, allowing the PhantomRaven payload to be downloaded during installation.

Once installed, a preinstall script executed automatically and began collecting data from the infected system. CrowdStrike said the stealer harvested operating system details, hostnames, local and external IP addresses, process information, usernames, email addresses from Git and npm configuration files, and a range of continuous integration and deployment environment variables associated with GitHub Actions, GitLab CI, Jenkins and CircleCI.

That focus suggests the malware was designed not only to identify a victim system but also to uncover credentials, tokens and other information that could support access claims. The data was then sent through HTTP GET and POST requests to attacker-controlled servers.

AI markers

CrowdStrike assessed with high confidence that the code behind PhantomRaven was generated with a large language model. The firm pointed to verbose comments before almost every function and variable, placeholder infrastructure references, and token-analysis patterns it said were consistent with machine-generated output.

The report said those markers also suggested the author's technical sophistication was likely low. Even so, the actor produced a functioning stealer that collected system and development-environment data and included an incomplete fallback method using WebSocket communication.

The findings add to broader concerns in the security sector that generative AI tools are lowering the skill threshold needed to create malware. In this case, CrowdStrike said AI appeared to have been used to support a custom tool aimed at a narrow commercial objective rather than mass theft or resale.

Trail of identities

CrowdStrike linked the operation to several online identities using naming patterns, email references and package metadata. It said the email address used by the actor in contact with a potential victim contained the string JPD, a detail also found across npm usernames associated with the campaign.

Related usernames had also surfaced in earlier industry reporting on PhantomRaven deployments. CrowdStrike identified overlaps between package publisher names, social media handles and a GitHub account that had previously interacted with PyPI after an attempted package upload was blocked.

According to the report, that GitHub exchange led to the removal of a project suspected of being an information stealer. CrowdStrike said Python files that remained accessible contained code similar to PhantomRaven, suggesting the actor had experimented beyond JavaScript and npm.

Defensive shift

The report notes that npm has since changed the behaviour of preinstall scripts in later versions of its package manager. In version 12 and later, developers are shown a warning and must explicitly approve such scripts before they can run when delivered as a dependency.

CrowdStrike said that change could blunt the technique used in PhantomRaven campaigns. It also urged organisations to use private registries where possible, restrict script execution by default, and train developers to recognise dependency-confusion attacks.

"This threat actor's behavior represents an expansion of known eCrime activities. Most criminal actors that CrowdStrike Intelligence tracks rent commodity tools or operate their own proprietary malware; however, this actor has likely developed their proprietary PhantomRaven to compromise company assets and then used these compromises as leverage to claim rewards from reputable disclosure programs. eCrime actors will likely continue integrating AI-generated tooling into their operations, as these tools reduce technical barriers to participating in eCrime activity and accelerate tool creation," CrowdStrike said.