cyber.hendryadrian.com
Threat Research · crowdstrike.com

CrowdStrike Details PhantomRaven, an npm Information Stealer Likely Built with LLM Assistance

· Original article ↗

Summary

CrowdStrike describes PhantomRaven, a JavaScript stealer delivered through typosquatted npm packages that collects system, credential-related and CI/CD data. npm 12 blocks dependency install scripts by default unless developers approve them.

Key points

  • Typosquatted npm packages used HTTP-hosted dependencies and preinstall scripts to fetch and run PhantomRaven.
  • The malware collected system details, Git and npm configuration data, and CI/CD environment variables that may contain secrets.
  • It sent collected data to attacker-controlled infrastructure through HTTP GET and POST requests; the code also contained an incomplete WebSocket fallback.
  • CrowdStrike assessed with high confidence that the code was likely LLM-generated, citing verbose comments, placeholder code and token-analysis patterns.
  • The operator posed as a bug bounty hunter; CrowdStrike said it had not observed PhantomRaven logs for sale and assessed the stealer was likely used to identify bounty opportunities.
  • CrowdStrike said its Falcon Complete team responded to and remediated multiple incidents involving PhantomRaven.
  • The article says npm 12 or later blocks dependency install scripts by default unless developers approve them, and recommends controlled registries and limiting script execution.

Article Details

Attack Vectors
  • Typosquatted npm packages contained HTTP URL dependencies that fetched PhantomRaven from attacker-controlled infrastructure during installation.
  • The fetched package used an npm preinstall script to execute the JavaScript stealer automatically.
  • PhantomRaven collected system information, Git/npm configuration data, and CI/CD environment variables that could contain credentials or secrets.
  • The malware exfiltrated collected data through HTTP GET and POST requests; the code also contained an incomplete WebSocket fallback.
Defensive Notes
  • Consider using a private npm registry to control, block, and monitor package installations.
  • Configure npm to use --ignore-scripts by default and selectively allow scripts only for trusted packages.
  • Update npm to restrict preinstall and postinstall script execution by default.
  • Educate users about dependency-confusion attacks that abuse npm dependency resolution.
  • Use npm audit to check for known vulnerabilities and problems.

Indicators of compromise

TypeIndicatorContext
DOMAINnpm[.]jpartifacts[.]comAttacker-controlled domain used for PhantomRaven command and control and remote dependency delivery.
DOMAINpackages[.]storageartifact[.]comIdentified as a PhantomRaven C2 domain.
DOMAINpackages[.]storeartifact[.]comIdentified as a PhantomRaven C2 domain.
DOMAINregistry[.]storageartifact[.]comIdentified as a PhantomRaven C2 domain.
EMAILjpdtester01@gmail[.]comEmail address found in metadata of a Python information-stealer file associated by industry sources with PhantomRaven.
IPV454[.]173[.]15[.]59Identified as a PhantomRaven C2 server address.
SHA25695a7dcc6de46826b22c43bee7fc550f3b5e2e6cbc5f33b0c241faf523641cf63SHA-256 hash of a PhantomRaven sample.
SHA256c31831d47fcbf52ff1f4e61838611916a4276d005a564e69946d5dac04235eedSHA-256 hash of a PhantomRaven sample.
SHA256db3fe46df0a65fe9f8c99d2e11126a032a72e9814e354ce017448ce088a01e02SHA-256 hash of a PhantomRaven sample.

MITRE ATT&CK

T1005 · Data from Local SystemPhantomRaven collected system information, environment variables, and configuration files from the infected system.T1016.001 · Internet Connection DiscoveryPhantomRaven queried https[:]//api64[.]ipify[.]org?format=json to determine the infected system's external IP address.T1027.009 · Embedded PayloadsMalicious payloads were delivered behind HTTP URL dependencies that were not displayed in npm's web interface.T1036.005 · Match Legitimate Resource Name or LocationTyposquatted package names, including transform-jsbi-to-bigint and sort-imports-es6-autofix, mimicked legitimate development packages.T1041 · Exfiltration Over C2 ChannelCollected data was sent to the operator's C2 servers through HTTP GET and POST requests.T1059.007 · JavaScriptPhantomRaven executes as JavaScript in the NodeJS runtime.T1071.001 · Web ProtocolsPhantomRaven used HTTP GET and POST requests to communicate with C2 infrastructure.T1072 · Software Deployment ToolsAn npm preinstall script automatically executed the payload during package installation.T1082 · System Information DiscoveryPhantomRaven collected OS type, architecture, hostname, NodeJS version, process ID, and current working directory.T1083 · File and Directory DiscoveryThe malware searched for and read package.json, Git configuration, and npm configuration files.T1119 · Automated CollectionCollection and exfiltration were performed automatically after malware execution, without user interaction.T1195.001 · Compromise Software Dependencies and Development ToolsTyposquatted npm packages fetched malicious HTTP URL dependencies during installation to deliver PhantomRaven.T1552.001 · Credentials In FilesPhantomRaven searched Git and npm configuration files for email addresses and credentials.T1552.007 · Container APIThe malware collected CI/CD environment variables from GitHub Actions, GitLab CI, Jenkins, and CircleCI that could contain authentication tokens or API keys.T1583.001 · DomainsThe operator registered and operated domains for PhantomRaven C2 infrastructure.T1587.001 · MalwareThe operator developed the PhantomRaven stealer, with CrowdStrike assessing that its code was likely LLM-generated.

Malware

PhantomRavenCrowdStrike identified PhantomRaven, a JavaScript information stealer distributed through malicious npm packages and likely written with help from a large language model, with the operator posing as a bug bounty hunter

Products

CircleCIThe malware collected system details, credentials-related data, and CI/CD environment variables from GitHub Actions, GitLab CI, Jenkins, and CircleCI.GitHub ActionsThe malware collected system details, credentials-related data, and CI/CD environment variables from GitHub Actions, GitLab CI, Jenkins, and CircleCI.GitLab CIThe malware collected system details, credentials-related data, and CI/CD environment variables from GitHub Actions, GitLab CI, Jenkins, and CircleCI.JenkinsThe malware collected system details, credentials-related data, and CI/CD environment variables from GitHub Actions, GitLab CI, Jenkins, and CircleCI.npmCrowdStrike identified PhantomRaven, a JavaScript information stealer distributed through malicious npm packages and likely written with help from a large language model, with the operator posing as a bug bounty hunter

Industries

Hospitalitythe threat actor has collected bounties from at least nine entities across the technology, retail, and hospitality sectors using reputable bug bounty submission platforms, including Bugcrowd, Intigriti, YesWeHack,RetailX profile, the threat actor has collected bounties from at least nine entities across the technology, retail, and hospitality sectors using reputable bug bounty submission platforms, including Bugcrowd, Intigriti,Technologytheir public X profile, the threat actor has collected bounties from at least nine entities across the technology, retail, and hospitality sectors using reputable bug bounty submission platforms, including Bugcrowd,

Related Articles