Phantomraven Llm Generated Information Stealer For Bug Bounty Hunting

CrowdStrike Counter Adversary Operations identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript (JS)-based information stealer PhantomRaven via npm, a platform on which developers can access open-source packages to build applications and software. The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose , placeholder code, and statistical token-analysis patterns.

Threat Actor Profile and Attribution

In November 2025, the threat actor deploying PhantomRaven contacted a potential victim organization and claimed to have identified a compromised device. The threat actor attributed the compromise to a dependency-confusion attack that used malicious npm packages to deploy PhantomRaven . The email address used to the potential victim included the string JPD as part of the username.

The PhantomRaven operator is a self-proclaimed bug bounty hunter who has been active since November 2022. According to their public X profile, the threat actor has collected bounties from at least nine entities across the technology, retail, and hospitality sectors using reputable bug bounty submission platforms, including Bugcrowd, Intigriti, YesWeHack, HackenProof, and HackerOne. To date, CrowdStrike Counter Adversary Operations has not observed PhantomRaven logs for sale on log shops, further indicating that PhantomRaven ’s operator likely uses the information stealer solely to identify bug bounty opportunities.

CrowdStrike Falcon® Complete managed detection and response (MDR) responded to and remediated multiple incidents involving PhantomRaven . Falcon Complete identified two npm packages containing PhantomRaven scripts: transform-jsbi-to-bigint , published by npm user jpdhellonpm1 , and sort-imports-es6-autofix , published by npm user jpd15 . The threat actor discussed in this post likely operates both monikers; this assessment is made with high confidence, as both PhantomRaven packages contain files with the threat actor’s name and initials in the description and author fields, respectively, and both usernames include the string JPD from the initial email (Figures 1 and 2).

The usernames jpdhellonpm1 and jpd15 are similar to usernames that industry sources associate with PhantomRaven deployments using malicious npm packages. These usernames include jpd12 , jpd13 , npmhell , npmpackagejpd , npmtestdharsh , jpdhackerone11 , and packagedharsh . 1 Two of these monikers contain characters that appear in the threat actor’s name, X account username, and email address, the latter of which has been used to potential victims. Moreover, the username jpdhackerone11 references HackerOne, a platform that the threat actor claims they use to manage their bug submissions and payments.

npm profiles associated with jpdhellonpm1 and jpd15 have published packages containing files that include remote dynamic dependency (RDD) links to the domain npm[.]jpartifacts[.]com . November 2025 PhantomRaven incidents leveraged this domain for command and control (C2).

In August 2025, the threat actor claimed to have discovered a remote code execution (RCE) vulnerability via a malicious npm package they published. The threat actor explained that they had compromised the target machine and executed their preinstall script, which purportedly allowed them to achieve RCE. While CrowdStrike Counter Adversary Operations could not verify this claim, a November 2025 PhantomRaven campaign exhibited similar techniques.

In December 2025, CrowdStrike Counter Adversary Operations identified the threat actor’s GitHub account. In February 2025, the threat actor used this account to submit a GitHub issue on PyPI, asking why their code failed to upload to PyPI. A member of the PyPI organization replied that PyPI does not allow projects with names that are similar to existing or deleted projects (a policy consistent with preventing dependency-confusion attacks) and further accused the threat actor of attempting to build an information stealer.

As evidence of their accusations, the PyPI organization member provided a link to the threat actor’s main project, which was subsequently removed from the platform. However, multiple associated Python files currently remain accessible. Analysis of these files reveals they contain code for an information stealer similar to PhantomRaven . However, unlike previously identified PhantomRaven samples that leverage JS and npm, this tool uses Python and PyPI. One analyzed Python file contains metadata, including the email address jpdtester01@gmail[.]com ; industry sources associate this username with PhantomRaven . 2

The threat actor distributes the malware via typosquatted npm packages that contain minimal, non-malicious code; typically, a simple Hello, world! script. However, the packages also specify a dependency via an HTTP URL rather than a standard npm package reference. At installation, npm fetches this remote dependency from attacker-controlled infrastructure; the returned package is the PhantomRaven payload.

The fetched malicious package includes a preinstall script 3 that automatically executes during installation. In June 2026, npm released a new version of its package manager to prevent preinstall scripts from executing in packages when included as a dependency unless the developer explicitly allows this activity. 4

In npm version 12 or later, if a developer attempts to install a dependency package with a preinstall script, they receive a warning message indicating that the script has been blocked and will not automatically execute. Only after the developer explicitly approves the preinstall script does it execute. Figure 3 shows what developers see when the preinstall script is blocked and presented for the developer’s inspection.

Figure 3. Installation messages displayed to developer in npm version 12 or later

PhantomRaven is a simple JS information stealer that exfiltrates system information and continuous integration/continuous deployment (CI/CD)-related environment variables, likely in an attempt to collect account credentials. The code was almost certainly LLM-generated, and the author’s technical sophistication is likely low.

The malware collects the following information (Table 1).

CIRCLE_PROJECT_REPONAME

To determine the current external IP address of the system on which the malware is executing, PhantomRaven contacts https[:]//api64[.]ipify[.]org?format=json . After this request has concluded (regardless of success), the malware exfiltrates all collected information via HTTP GET and POST requests.

The GET request encodes the data as a query string parameter while the POST request serializes the data as JSON before placing it in the POST body. For the POST method, PhantomRaven uses the very minimal user-agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) . The user agent is valid but misses many common elements, including browser type and version.

PhantomRaven ’s code also contains an incomplete fallback WebSocket exfiltration method. However, the code’s hardcoded exfiltration URL is wss[:]//yourserver[.]com/socket — highly likely a placeholder and not malicious infrastructure.

LLM-Generated Code Characteristics

PhantomRaven ’s code was almost certainly LLM-generated. This assessment is made with high confidence based on statistical token-analysis patterns as well as verbose and placeholder code, which indicate the text is highly consistent with a generated LLM token stream. LLM generation explains several unusual design choices, including exfiltrating data via both HTTP POST and GET requests.

Figure 4 shows a heavily abridged rendering of the source code’s topmost structure and associated . In this code snippet, the marker /.../ indicates an omission; all starting with // are present in PhantomRaven ’s code as shown. The code includes a before every global variable and function definition, despite obvious redundancy between the ’s explanation and the defined symbol’s name.

Figure 4. Verbose PhantomRaven code

This threat actor’s behavior represents an expansion of known eCrime activities. Most criminal actors that CrowdStrike Counter Adversary Operations tracks rent commodity tools or operate their own proprietary malware; however, this threat actor has likely developed their proprietary PhantomRaven to compromise company assets and then used these compromises as leverage to claim rewards from reputable disclosure programs.

eCrime threat actors will likely continue integrating AI-generated tooling into their operations, as these tools reduce technical barriers to participating in eCrime activity and accelerate tool creation. This assessment is made with moderate confidence based on the observed PhantomRaven deployment, as well as deployment of multiple likely AI-generated tools by several big game hunting (BGH) adversaries, including a TRAVELING SPIDER INC affiliate and PUNK SPIDER, who deployed AI-generated PowerShell (PS) scripts for operations throughout late 2025 and early 2026.

These recommendations can be implemented to help protect against the activity described in this report:

Consider implementing a private npm registry (where package installations can be controlled, blocked, and monitored) rather than using the official npm registry

Configure npm to use --ignore-scripts by default, and selectively enable script execution only for trusted packages 5

Update npm to the latest version to restrict preinstall and postinstall script execution by default

Educate users on dependency-confusion attacks that exploit npm’s dependency resolution to deliver malicious packages

Use npm audit for known vulnerabilities and problems

Table 2 details the tactics and techniques described in this blog post.

Indicators of Compromise (IOCs)

Tune in to the Adversary Universe podcast , where CrowdStrike reveals the threat actors behind the latest cyberattacks.

Dive into more topics like this with Fal.Con Digital , featuring keynote livestreams and 100+ sessions available on demand.