PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting

Key Points:

• A financially motivated threat actor, identified as a bug bounty hunter, has developed and distributed the JavaScript-based information stealer PhantomRaven via typosquatted npm packages.
• The malware collects sensitive system information and CI/CD environment variables, posing a risk to organizations' credentials and operational security.
• Recommended actions include implementing a private npm registry, configuring npm to block scripts by default, updating to the latest npm version, and educating users on dependency-confusion attacks.

Technical Details: PhantomRaven utilizes typosquatted npm packages that fetch malicious dependencies via HTTP URLs during installation. It exfiltrates data using HTTP GET and POST requests to attacker-controlled domains.

MITRE ATT&CK Techniques:

• T1016.001 - System Network Configuration Discovery: Internet Connection Discovery (Reconnaissance)
• T1583.001 - Acquire Infrastructure: Domains (Resource Development)
• T1587.001 - Develop Capabilities: Malware (Resource Development)
• T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools (Initial Access)
• T1059.007 - Command and Scripting Interpreter: JavaScript (Execution)
• T1072 - Software Deployment Tools (Execution)
• T1027.009 - Obfuscated Files or Information: Embedded Payloads (Defense Evasion)
• T1036.005 - Masquerading: Match Legitimate Name or Location (Defense Evasion)
• T1552.001 - Unsecured Credentials: Credentials In Files (Credential Access)
• T1552.007 - Unsecured Credentials: Container API (Credential Access)
• T1082 - System Information Discovery (Discovery)
• T1083 - File and Directory Discovery (Discovery)
• T1614.001 - System Location Discovery: System Language Discovery (Discovery)
• T1005 - Data from Local System (Collection)
• T1119 - Automated Collection (Collection)
• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1104 - Multi-Stage Channels (Command and Control)
• T1041 - Exfiltration Over C2 Channel (Exfiltration)

IOCs Mentioned:

• packages[.]storeartifact[.]com
• registry[.]storageartifact[.]com
• npm[.]jpartifacts[.]com
• 54.173.15[.]59
• SHA256 hashes of PhantomRaven payloads:
  • c31831d47fcbf52ff1f4e61838611916a4276d005a564e69946d5dac04235eed
  • 95a7dcc6de46826b22c43bee7fc550f3b5e2e6cbc5f33b0c241faf523641cf63
  • db3fe46df0a65fe9f8c99d2