PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting

MITRE Techniques

• [T1016.001 ] System Network Configuration Discovery: Internet Connection Discovery – PhantomRaven queried a public service to determine the victim’s external IP address (‘contacts https://api64.ipify.org to determine the infected system’s external IP address’).
• [T1583.001 ] Acquire Infrastructure: Domains – The threat actor registered and operated domains for command-and-control infrastructure (‘registered and operated multiple domains for C2 infrastructure’).
• [T1587.001 ] Develop Capabilities: Malware – The actor developed PhantomRaven, likely with AI assistance (‘developed PhantomRaven, likely using an LLM to generate the JS code’).
• [T1195.001 ] Supply Chain Compromise: Compromise Software Dependencies and Development Tools – Malicious npm packages were published to deliver the stealer through dependency installation (‘published typosquatted npm packages that fetched malicious dependencies via HTTP URLs during installation’).
• [T1059.007 ] Command and Scripting Interpreter: JavaScript – The malware executed as JavaScript in the NodeJS runtime (‘PhantomRaven executes as JS code within the NodeJS runtime environment’).
• [T1072 ] Software Deployment Tools – npm preinstall scripts were used to automatically run the payload during installation (‘leverages npm’s preinstall script functionality to automatically execute during package installation’).
• [T1027.009 ] Obfuscated Files or Information: Embedded Payloads – The payload was hidden behind HTTP URL dependencies not visible in npm’s web interface (’embedded malicious payloads behind HTTP URL dependencies that are not displayed in npm’s web interface’).
• [T1036.005 ] Masquerading: Match Legitimate Name or Location – Typosquatted package names were made to resemble legitimate tools (‘Typosquatted package names mimic legitimate development tools and libraries’).
• [T1552.001 ] Unsecured Credentials: Credentials In Files – The malware searched Git and npm configuration files for email addresses and credentials (‘searches Git and npm configuration files for email addresses and credentials’).
• [T1552.007 ] Unsecured Credentials: Container API – CI/CD-related environment variables were collected and may have contained secrets (‘collects CI/CD-related environment variables from GitHub Actions, GitLab CI, Jenkins, and CircleCI’).
• [T1082 ] System Information Discovery – The malware gathered host and runtime details (‘collects OS type, architecture, hostname, NodeJS version, process ID, and current working directory’).
• [T1083 ] File and Directory Discovery – The malware searched for configuration and project files (‘searches for and reads package.json files, Git configuration files, and npm configuration files’).
• [T1614.001 ] System Location Discovery: System Language Discovery – The malware collected location and time-zone related information (‘collects system location and time zone information’).
• [T1005 ] Data from Local System – PhantomRaven collected information directly from the infected system (‘collects system information, environment variables, and configuration files’).
• [T1119 ] Automated Collection – Collection and exfiltration occurred automatically after execution (‘performed automatically upon malware execution, without user interaction’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – Exfiltration used HTTP GET and POST requests (‘uses HTTP GET and POST requests to communicate with C2 infrastructure’).
• [T1104 ] Multi-Stage Channels – The code included redundant communication methods with a fallback WebSocket path (‘includes both HTTP-based exfiltration and an unfinished WebSocket fallback method’).
• [T1041 ] Exfiltration Over C2 Channel – Collected data was sent to attacker-controlled servers (‘exfiltrated to the threat actor’s C2 servers via HTTP GET and POST requests’).