Contents may be malicious. [Research Saturday]

Host Dave Bittner introduces Adam Myers, CrowdStrike’s head of counter-adversary operations, to discuss the research report “Phantom Raven, an LLM-generated information stealer developed for bug bounty hunting.” Myers says CrowdStrike began tracking the threat actor after noticing the tool being deployed. The tool was an information stealer, and the researchers’ initial focus was understanding the malicious tooling before they identified the broader activity around it. Myers rejects the idea that the operator should straightforwardly be called a bug bounty hunter. Although the actor reportedly claims to find vulnerabilities and obtain bug-bounty payments, Myers characterizes the behavior as gaming the system: the actor uses malware to gain access to other people’s systems, then monetizes that access by reporting the resulting compromise to organizations. In his view, calling the person a legitimate researcher would be “a very generous way of characterizing them.” The distinction matters because legitimate bug bounty researchers generally examine software for vulnerabilities and disclose them responsibly through an established program. Phantom Raven’s operator instead distributes a malicious JavaScript tool, gains access to a victim, and then contacts the organization while claiming to have identified a compromised device.

Myers explains that Phantom Raven is distributed through the Node Package Manager ecosystem, which is widely used by developers working with Node.js. The actor uses typosquatting: a developer who intends to install a legitimate package, such as one with a name resembling “transform-jsbi-2-bigint,” may mistype it and accidentally install the malicious lookalike instead. The npm packages themselves contain relatively little obviously malicious code. Their package files include remote dynamic dependencies that point back to a domain CrowdStrike believes functions as the actor’s command-and-control infrastructure. When the package is installed and executed, the remote dependency supplies the malicious JavaScript, which then runs and calls back to that domain. Once active, Phantom Raven collects a broad set of information. Myers lists the operating system, hostname, IP addresses, running processes, runtime information, the directory and process IDs associated with execution, the installed Node.js version, command-line arguments, username, and date and time. It also gathers build-environment variables, including project paths and versions, as well as information from GitHub Actions. Those CI/CD details may expose credentials or other secrets used by automated development and deployment systems.

Bittner asks why CrowdStrike concluded that the stealer was probably generated with a large language model. Myers says the researchers have observed threat actors incorporating LLMs into their workflows for roughly the past two years. The resulting code often has better comments and error handling than the actor would likely have written unaided. CrowdStrike also performs statistical token analysis across scripts to estimate whether code was generated by an LLM. In Phantom Raven, one clue was that the code included a comment before virtually every global variable. The comments explained functions such as collecting CI/CD and environment information, collecting system information, and dynamically fetching a public IP address. Myers says such verbose documentation is unnecessary for the malware author but is typical of an LLM trying to make generated code easier for its user to understand. The researchers nevertheless rated the author’s technical sophistication as relatively low. When Bittner points out that the actor still produced a functioning information stealer, Myers answers that the actor told an LLM to build it. He says sophistication is less important than results: if the malware works reliably and lets the operator obtain information and monetize access, it is “good enough.” The quality matters insofar as faulty or unreliable code could corrupt the stolen data or prevent the operation from succeeding.

Myers says developers should treat Phantom Raven as part of a larger CI/CD security problem. Organizations increasingly rely on systems that automatically consume and deploy code after someone pushes it to a repository. That means a package published by someone on the other side of the world can move through an automated pipeline and enter an organization’s environment without a person consciously approving that specific change. His primary recommendation is a package cool-off period: newly published packages should not be deployable until three days after publication. The delay creates time to identify malicious packages before they are automatically incorporated. He also warns developers not to fall victim to typosquatted packages and recommends continuous checks against approved packages so that unauthorized Node, Python, or other repository packages can be detected. The description of the research additionally points to restricting package-installation scripts, using private npm registries, and monitoring dependencies as mitigation measures. Myers emphasizes that the problem is not limited to npm; CrowdStrike has seen similar activity in Python and other repository ecosystems. Organizations need to understand the risks created by their particular repositories and automation, rather than assuming that a package is safe simply because the development workflow installs it automatically.

Bittner asks whether the growing use of AI-generated malware should change what defenders look for. Myers says it should not fundamentally change the defensive approach. Threat actors have increasingly used LLMs to build tools, scripts, and malicious code, but the central question remains what the code does when it is instantiated in the environment. An LLM may produce code that is more clearly documented or better structured than human-written malware, but that does not make its behavior harmless. Myers says defenders need adequate visibility to detect when the code executes and what actions it performs. The focus should therefore remain on monitoring activity, controlling how dependencies enter development environments, and identifying unexpected access to system and CI/CD information. For organizations operating bug-bounty programs, Myers says the Phantom Raven activity demonstrates a novel abuse pattern. Programs intended to improve security can be manipulated when an actor creates or induces a compromise and then reports it as a vulnerability. Organizations should understand that this capability exists and account for it when evaluating bug-bounty submissions, rather than assuming every claimed finding came from conventional, responsible research.

The conversation closes on the tension between pressure to move quickly and the need to pause before deploying new code. Myers agrees that a short delay can be the safer choice for package rollouts. He cites a recent example involving the group CrowdStrike calls Altered Spider, also known to many as Team PCP, which infected more than 300 repositories in a single day. He says supply-chain attacks have become an increasing problem, including campaigns by North Korean threat actors, criminal groups, and other adversaries targeting development and package ecosystems. A malicious dependency can remain in an environment for months or even years if the organization lacks the controls and visibility needed to notice it. Myers’s main takeaway is that organizations must put policies and checks around automated package consumption and CI/CD deployment. The goal is not to reject automation or AI-generated code solely because of how it was produced. Instead, defenders should ensure that new code is approved, dependencies are monitored, typosquatting is detected, and runtime behavior is visible before an apparently minor package change becomes an organization-wide compromise.