The Evidence That AI Wrote PhantomRaven Is Its Comments

20 SEP 2026 — CrowdStrike says the npm stealer PhantomRaven was almost certainly written by a large language model. The evidence is not a leaked prompt or a confession. It is that the code comments every global variable, and one function still points at wss://yourserver.com/socket.

That may well be right. The question is what kind of claim this is.

What the malware does

PhantomRaven is a JavaScript information stealer distributed through npm. It uses slopsquatting and typosquatting with names close enough to real packages, including some that AI assistants tend to hallucinate.

CrowdStrike's analysis shows the stealer collects the operating system, architecture, hostname and IP addresses, CI/CD environment variables, Git and npm credentials, and timestamps. It sends them by HTTP GET and POST to attacker-controlled domains including npm.jpartifacts.com.

Two of the packages named are transform-jsbi-to-bigint and sort-imports-es6-autofix. CrowdStrike's managed detection team responded to multiple incidents, with initial contact at a victim in November 2025.

The three indicators

CrowdStrike makes the assessment with high confidence, and it rests on style rather than provenance.

First, statistical token-analysis patterns, which CrowdStrike says indicate text highly consistent with a generated LLM token stream. Second, verbose commenting. A comment sits before every global variable and function definition despite the obvious redundancy. Third, placeholder code. An incomplete WebSocket method still carries a hardcoded example URL.

Together, those are a reasonable basis for a confidence judgement. Taken separately, the second and third describe plenty of ordinary human code. People write redundant comments when they have been told to comment everything, and a placeholder URL left in a shipped artefact is one of the most common mistakes in software.

Why the motive is stranger than the tooling

The operator presents publicly as a bug bounty hunter, active since November 2022, claiming bounties from nine entities across technology, retail and hospitality through Bugcrowd, Intigriti, YesWeHack, HackenProof and HackerOne.

CrowdStrike states it has not observed PhantomRaven logs for sale on log shops. It reads that absence as a sign the operator uses the stealer to identify bug bounty opportunities rather than to sell stolen data.

If that reading holds, the malware is not the interesting part. The business model is mass credential collection used as reconnaissance for legitimate-looking vulnerability submissions. The stolen data never gets sold because selling it was never the point.

What an LLM claim is worth

Compare this with the other AI-and-security story of the week. Yesterday we reported on three researchers who used Claude Opus 5 to write a working exploit. There, the model's involvement was not inferred. The researchers described the model, the day, what it failed at first, and what it produced in about three hours.

Here the same claim is an inference from the code itself. It is a legitimate method, but weaker, because the stylistic tells are not exclusive to machine authorship.

The distinction matters as these assessments accumulate. "Written with an LLM" is becoming a standard line in threat reporting. If it cannot be falsified from the evidence offered, the label will eventually be applied to code that was simply written by a person, carefully or carelessly.