AI-Generated Malware PhantomRaven Targets Bug Bounty Programs

• •PhantomRaven is an AI-generated information stealer targeting bug bounty programs.
• •The malware is distributed via malicious npm packages, affecting multiple sectors.
• •CrowdStrike has not seen stolen data from PhantomRaven sold on criminal marketplaces.

CrowdStrike has identified a financially motivated hacker who developed the PhantomRaven information stealer using a large language model. The malware, distributed through malicious npm packages, targets companies in technology, retail, and hospitality sectors. The hacker has claimed bounties from at least nine organizations since November 2022. PhantomRaven collects sensitive information, including credentials, from compromised systems. CrowdStrike has responded to multiple incidents involving this malware but has not observed stolen data being sold on criminal marketplaces. The threat actor operates under multiple usernames, suggesting a strategic approach to evade detection while participating in bug bounty programs. The use of AI in creating malware lowers the technical barriers for cybercriminals, enabling less sophisticated actors to engage in cybercrime.