A self-described bug bounty hunter allegedly found a shortcut to discovering vulnerabilities: compromise organizations first, then search the resulting access for flaws worth reporting.
CrowdStrike has linked a JavaScript information stealer to a self-described bug bounty hunter who claims to have collected rewards from at least nine organizations. The malware, named PhantomRaven, is distributed through malicious npm packages and harvests information from developer machines and environments, including Git and npm configuration data.
Importantly, CrowdStrike says it has not seen any of the data PhantomRaven collected being sold on credential markets where infostealer logs are commonly sold. Instead, it assesses that the operator likely built the malware to gain information and access that could expose vulnerabilities, which could then be reported through established bug bounty platforms for profit.
When bug hunting crosses into unauthorized access
Legitimate bug bounty programs depend on researchers staying within clearly defined authorization boundaries. CrowdStrike’s findings suggest PhantomRaven may have crossed those boundaries by using malware to gain access before searching for reportable flaws.
According to The Hacker News, researchers at Koi Security and DCODX first discovered PhantomRaven in October 2025, even though CrowdStrike says it has been active since at least November 2022.
PhantomRaven was distributed through malicious npm packages designed to appear useful or legitimate to developers.
In the initial observation by Koi Security and DCODX, over 100 malicious packages were uploaded to the npm directory, with developers as the obvious target. The infostealer malware, hiding as npm packages, then scans its victims' devices for information including authentication tokens, CI/CD secrets, IP addresses, email addresses, and GitHub credentials while running a fingerprint scan on the device.
According to CrowdStrike, the apparent goal was not credential resale or conventional account takeover. Instead, the company assesses that the operator used the stolen information to identify bug bounty opportunities and claims to have received rewards from nine organizations across several industries.
That creates the unusual sequence at the heart of this case: the operator allegedly obtained access through malware, used the resulting visibility to find security weaknesses, and then pursued bug bounty payments for what they found. The vulnerability reports may have entered a legitimate disclosure process, but the access used to discover them did not, creating an ethical dilemma.
An LLM helped develop the malware
CrowdStrike's analysis of PhantomRaven also found signs that an LLM likely helped write the malware, and the researchers assigned the assessment high confidence.
The researchers' AI claims stem from several characteristics in the malware's code. These include statistical patterns associated with generated code, unusually verbose and explanatory comments, placeholder code that was not properly replaced, redundant implementations, and other coding patterns commonly seen in LLM-generated output.
The malware also had incomplete functionality, including an unfinished WebSocket fallback mechanism, suggesting the code was not especially polished.
That combination is what makes the finding notable: PhantomRaven did not need to be expertly engineered to work. An actor with enough technical knowledge to direct an LLM, adapt its output, and deploy the resulting code could potentially use AI to lower some of the expertise traditionally required to build malware.
Lessons from this incident
The first lesson is that developer environments deserve the same security attention as production systems.
A developer's machine holds several credentials and secrets that can grant an attacker a path far beyond a single compromised device, making developer workstations and build environments attractive targets in their own right.
The incident also shows that unquestioningly trusting software dependencies can be dangerous, particularly open-source software, which is often associated with high levels of trust. IT teams can help by specifying recommended, verified dependencies.
Developers should also avoid giving development tools more credentials or system access than they actually need.
Finally, PhantomRaven shows that AI-assisted malware development does not need to produce sophisticated code to create a real security problem. The malware may have been imperfect, but it was functional enough to target valuable developer information.
This shows that while AI companies add tougher guardrails to sophisticated models and restrict some to authorized parties to prevent misuse, an actor using readily available AI assistance may still be able to produce functional malware even without highly polished code.
That said, defenders have to account for this when planning their defense strategy.
Other news: AI agents exploited PaperCut vulnerabilities to compromise at least 440 servers across 395 organizations in 48 countries, with one burst breaching 11 organizations in just 26 seconds.