PhantomRaven malware distributed via npm package registry

A financially motivated threat actor has been linked to the development and distribution of a JavaScript-based information stealer known as PhantomRaven via the npm package registry, according to a recent report by The Hacker News.

The malware, likely developed using a large language model, according to CrowdStrike's Counter Adversary Operations, was distributed through typosquatted and slopsquatted npm packages. These packages aimed to steal authentication tokens, CI/CD secrets, and GitHub credentials from developers. The attack chain involved a remote dynamic dependency to evade security tools. Once installed, PhantomRaven collects sensitive information including email addresses, CI/CD environment details, and system fingerprints, transmitting them to an attacker-controlled server.

The threat actor, active since November 2022, claims to be a bug bounty hunter who has targeted at least nine entities across technology, retail, and hospitality sectors. CrowdStrike noted that stolen information has not appeared on stealer log shops, suggesting the malware is used primarily to identify bug bounty opportunities. The actor also attempted to distribute similar malware on the Python Package Index (PyPI).

Source: The Hacker News