PhantomRaven: AI‑Powered JavaScript Stealer Turns Bug‑Bounty Tactics into a Profit Engine

In a twist that blurs the line between white‑hat research and cybercrime, CrowdStrike uncovered a JavaScript‑based data‑stealer dubbed PhantomRaven that was crafted by a financially motivated threat actor who also works as a bug bounty hunter.

What PhantomRaven Does

PhantomRaven is a lightweight script that injects into web pages, harvesting credentials, session tokens, and other sensitive information. Its code is heavily obfuscated, making manual analysis time‑consuming. The tool’s authors claim it was built with the help of large language models, allowing rapid iteration and customization for target sites.

How It Was Spread

The actor distributed the script through public code repositories and private channels used by security researchers. By masquerading as a legitimate bounty‑hunting tool, the attacker lowered the barrier for malicious use and increased the reach of the stealer.

Detection & Mitigation

• CrowdStrike’s Falcon platform flagged the script’s signature in real‑time, triggering alerts for affected endpoints.
• Endpoint isolation and script quarantine prevented credential exfiltration on most machines.
• Security teams are advised to audit third‑party scripts and enforce strict content‑security policies.

“When a tool designed for vulnerability hunting turns into a revenue engine for theft, it signals that the threat landscape is evolving faster than the defenses we rely on.” – CrowdStrike Research Lead

RootPwn will continue to monitor PhantomRaven’s evolution and share updates on mitigation strategies.