LLM-written PhantomRaven malware steals npm and GitHub credentials

Sep 15, 2026 · Issue 7 · 5 sources, 5 articles

The PhantomRaven information stealer, created with the help of an LLM, harvests npm and GitHub credentials and also deceived bug bounty programs. The reports appeared between 15 and 18 September.

Who is affected and how

senior developer

Before installing a dependency, check the package's origin and its install scripts.

Sources

• Hacker used AI to create malware and trick bug bounty programsaxios.com · Sep 15, 2026
• Hacker Used AI Stealer for Bug Bounty Rewards | ForkLogforklog.com · Sep 17, 2026
• PhantomRaven: LLM-generated Information Stealer for Bug Bounty Huntingcrowdstrike.com · Sep 15, 2026
• LLM помогнал во создавањето на PhantomRaven, малвер кој краде npm и GitHub акредитиви | MKD-CIRT | Национален центар за одговор на компјутерски инцидентиmkd-cirt.mk · Sep 18, 2026
• LLM-Built PhantomRaven Stealer Targets Developer Credentials via npmprotect.computer · Sep 19, 2026

Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.