Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer

Summary

CrowdStrike assessed with high confidence that a financially motivated threat actor likely used a large language model to write PhantomRaven, a JavaScript information stealer distributed through more than 100 typosquatted and slopsquatted npm packages. The packages retrieve a remote dynamic dependency that harvests developer email addresses, CI/CD environment variables for GitHub Actions, GitLab CI, Jenkins and CircleCI, system fingerprints including the public IP address, and Git/npm configuration details, then sends them to an attacker-controlled server. The operator, active since November 2022, appears to use the stolen data to find bug bounty opportunities rather than selling it.

Topics

• Model and package supply chain

Related items

• Infollm-gemini 0.37Same vendor · Simon Willison's Weblog
• InfoGoogle’s new Gemini model is better at understanding complicated questionsSame vendor · The Verge (AI)
• InfoNo, AI agents did not discover a previously unknown Maya siteSame vendor · The Verge (AI)
• InfoIntroducing Gemini 4 HydrogenSame vendor · DeepMind Safety Research
• LowAI chatbots are recommending fake retail websites, study findsSame vendor · The Verge (AI)