A hacker known as PhantomRaven has exploited AI malware in bug bounty attacks, posing risks to corporate systems since 2022.
CrowdStrike researchers have identified a hacker using AI-driven malware under the pseudonym PhantomRaven, who infiltrated systems while masquerading as a bug bounty hunter.
PhantomRaven embedded the malicious software within legitimate npm libraries, triggering a data-stealing function upon installation.
This attacker gathered system information to penetrate corporate assets, utilizing a classic software supply chain strategy. CrowdStrike characterized the malware as uncomplicated, suggesting that its code was likely crafted with the help of a large language model, evident from the verbose comments and template-like structures present in the scripts.
The analysis indicates that this hacker, who has been active since 2022, targeted companies in technology, retail, and hospitality, often reporting vulnerabilities to various bug bounty programs. His presence is corroborated by reward mentions on his X profile.
In November 2025, PhantomRaven reached out to a target, claiming their device had been compromised due to a different malicious npm package campaign.
The hacker also attempted to extend operations to the Python Package Index (PyPI), but was unsuccessful in uploading code. Analysis of the rejected files revealed similar data-stealing functionalities.
Although there is no evidence of the stolen data being sold on dark web platforms, it appears PhantomRaven’s primary goal was to exploit vulnerabilities for financial gain through bug bounty programs. CrowdStrike has since intervened in several incidents related to this hacker.
Experts noted that recent updates to npm have restricted such attack vectors by disabling installation scripts by default, enhancing security measures against this type of exploitation.
Moreover, as of September 2026, F6 analysts pointed out the increasing utilization of AI in cybercrime, with AI tools becoming a staple in various stages of cyberattacks, including reconnaissance and malicious code generation.
