Breaking

CrowdStrike Says AI-Written PhantomRaven Malware Was Used to Pursue Bug Bounty Payments

September 15, 2026 at 17:27 EDT

Security
Software Dev & Coding

CrowdStrike said a financially motivated hacker used likely LLM-generated malware to compromise developer environments, then used the access to search for vulnerabilities that could be submitted to legitimate bug bounty programs. The JavaScript information stealer, named PhantomRaven, was distributed through malicious npm packages and marks a notable example of generative AI lowering the bar for custom cybercrime tooling.

Sep. 15, 2026 · Cybersecurity

AI-written malware enters bug bounty hunting

PhantomRaven used malicious npm packages to compromise developer environments, collect development data and support bug bounty submissions.

entities tied to claimed bounty payouts

npm packages identified with PhantomRaven scripts

CI/CD platforms whose variables were collected

Scale of the campaign signals

identified npm packages

claimed bounty recipients

The strongest confirmed count is not victims, but the operator's public claim of bounty payments from at least nine entities.

How PhantomRaven worked

1. Typosquatted npm packageA small package appeared benign.

→

2. Remote dependencyInstallation fetched attacker-hosted code.

→

3. Data collectionSystem, Git, npm and CI/CD details were collected.

Why developers care

AI-assisted security work can speed legitimate vulnerability discovery when it stays within program rules and produces reproducible findings.

Why defenders worry

Using malware or poisoned packages to gain access before reporting bugs undermines the trust model behind bug bounty programs.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.