Threat
PhantomRaven: LLM-generated Information Stealer for Bug Bounty Hunting
Publication date not yet evaluated · Added · 2 reports crowdstrike.com
Page published
Coverage timeline
Why it matters
PhantomRaven shows LLM-generated malware moving from theory into real npm supply-chain intrusions, giving low-skill actors a way to build and deploy functional information stealers.
CrowdStrike Counter Adversary Operations attributes the JavaScript-based information stealer PhantomRaven, distributed via malicious npm packages (transform-jsbi-to-bigint and sort-imports-es6-autofix), to a financially motivated self-proclaimed bug bounty hunter using the moniker JPD. CrowdStrike assesses with high confidence that the operator wrote the malware with a large language model, based on verbose comments, placeholder code, and statistical token-analysis patterns, and Falcon Complete remediated multiple real incidents.