The usernames jpdhellonpm1 and jpd15 are similar to usernames that industry sources associate with PhantomRaven deployments using malicious npm packages. These usernames include jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11, and packagedharsh.¹ Two of these monikers contain characters that appear in the threat actor’s name, X account username, and email address, the latter of which has been used to contact potential victims. Moreover, the username jpdhackerone11 references HackerOne, a platform that the threat actor claims they use to manage their bug submissions and payments.

npm profiles associated with jpdhellonpm1 and jpd15 have published packages containing files that include remote dynamic dependency (RDD) links to the domain npm[.]jpartifacts[.]com. November 2025 PhantomRaven incidents leveraged this domain for command and control (C2).

In August 2025, the threat actor claimed to have discovered a remote code execution (RCE) vulnerability via a malicious npm package they published. The threat actor explained that they had compromised the target machine and executed their preinstall script, which purportedly allowed them to achieve RCE. While CrowdStrike Counter Adversary Operations could not verify this claim, a November 2025 PhantomRaven campaign exhibited similar techniques.

In December 2025, CrowdStrike Counter Adversary Operations identified the threat actor’s GitHub account. In February 2025, the threat actor used this account to submit a GitHub issue on PyPI, asking why their code failed to upload to PyPI. A member of the PyPI organization replied that PyPI does not allow projects with names that are similar to existing or deleted projects (a policy consistent with preventing dependency-confusion attacks) and further accused the threat actor of attempting to build an information stealer.

As evidence of their accusations, the PyPI organization member provided a link to the threat actor’s main project, which was subsequently removed from the platform. However, multiple associated Python files currently remain accessible. Analysis of these files reveals they contain code for an information stealer similar to PhantomRaven. However, unlike previously identified PhantomRaven samples that leverage JS and npm, this tool uses Python and PyPI. One analyzed Python file contains metadata, including the email address jpdtester01@gmail[.]com; industry sources associate this username with PhantomRaven.²

Infection Vector

The threat actor distributes the malware via typosquatted npm packages that contain minimal, non-malicious code; typically, a simple Hello, world! script. However, the packages also specify a dependency via an HTTP URL rather than a standard npm package reference. At installation, npm fetches this remote dependency from attacker-controlled infrastructure; the returned package is the PhantomRaven payload.

The fetched malicious package includes a preinstall script³ that automatically executes during installation. In June 2026, npm released a new version of its package manager to prevent preinstall scripts from executing in packages when included as a dependency unless the developer explicitly allows this activity.⁴

In npm version 12 or later, if a developer attempts to install a dependency package with a preinstall script, they receive a warning message indicating that the script has been blocked and will not automatically execute. Only after the developer explicitly approves the preinstall script does it execute. Figure 3 shows what developers see when the preinstall script is blocked and presented for the developer’s inspection.

Developer’s Project Run via npm install Command
added 1 package, and audited 3 packages in 148ms

found 0 vulnerabilities
npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
npm warn install-scripts   [developer-project-package]@1.0.0 (preinstall: node index.js)
npm warn install-scripts
npm warn install-scripts Run `npm install-scripts ls` to review, or `npm install-scripts approve <pkg>` to allow.

Malicious Project Run via npm install-scripts ls Command
1 package has install scripts blocked because they are not covered by allowScripts:
  [typosquatted/malicious-package]@1.0.0 (preinstall: node index.js)

Run `npm install-scripts approve <pkg>` to allow, or `npm install-scripts deny <pkg>` to deny.

Figure 3. Installation messages displayed to developer in npm version 12 or later

Technical Overview

PhantomRaven is a simple JS information stealer that exfiltrates system information and continuous integration/continuous deployment (CI/CD)-related environment variables, likely in an attempt to collect account credentials. The code was almost certainly LLM-generated, and the author’s technical sophistication is likely low.

The malware collects the following information (Table 1).

To determine the current external IP address of the system on which the malware is executing, PhantomRaven contacts https[:]//api64[.]ipify[.]org?format=json. After this request has concluded (regardless of success), the malware exfiltrates all collected information via HTTP GET and POST requests.

The GET request encodes the data as a query string parameter while the POST request serializes the data as JSON before placing it in the POST body. For the POST method, PhantomRaven uses the very minimal user-agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64). The user agent is valid but misses many common elements, including browser type and version.

PhantomRaven’s code also contains an incomplete fallback WebSocket exfiltration method. However, the code’s hardcoded exfiltration URL is wss[:]//yourserver[.]com/socket — highly likely a placeholder and not malicious infrastructure.

LLM-Generated Code Characteristics

PhantomRaven’s code was almost certainly LLM-generated. This assessment is made with high confidence based on statistical token-analysis patterns as well as verbose comments and placeholder code, which indicate the text is highly consistent with a generated LLM token stream. LLM generation explains several unusual design choices, including exfiltrating data via both HTTP POST and GET requests.

Figure 4 shows a heavily abridged rendering of the source code’s topmost structure and associated comments. In this code snippet, the marker /.../ indicates an omission; all comments starting with // are present in PhantomRaven’s code as shown. The code includes a comment before every global variable and function definition, despite obvious redundancy between the comment’s explanation and the defined symbol’s name.

const os = require("os");
const https = require("https");
const fs = require("fs");
const path = require("path");

// Function to detect user email from various sources
function detectUserEmail() {
    /*...*/
}

// Collect CI/CD and Environment Information
const ciEnvVars = {
    /*...*/
};

// Collect System Information
const systemInfo = {
    /*...*/
};
// Fetch public IP dynamically
https.get(/*...*/, (res) => {
    /*...*/
}).on("error", () => sendData(systemInfo));

// List of endpoints
const endpoints = {
    /*...*/
};

// Get available endpoint
function getEndpoint(type = 'log') {
    /*...*/
}
// Convert system info to query string
function buildQueryParams(data) {
    /*...*/
}

// New function to lookup systems by email
async function lookupByEmail(email) {
    /*...*/
}

// Send Data (GET and POST)
async function sendData(data) {
    /*...*/
}

// WebSocket Backup (if HTTP requests fail)
async function sendViaWebSocket(data) {
    /*...*/
}

Figure 4. Verbose PhantomRaven code comments

Assessment

This threat actor’s behavior represents an expansion of known eCrime activities. Most criminal actors that CrowdStrike Counter Adversary Operations tracks rent commodity tools or operate their own proprietary malware; however, this threat actor has likely developed their proprietary PhantomRaven to compromise company assets and then used these compromises as leverage to claim rewards from reputable disclosure programs.

eCrime threat actors will likely continue integrating AI-generated tooling into their operations, as these tools reduce technical barriers to participating in eCrime activity and accelerate tool creation. This assessment is made with moderate confidence based on the observed PhantomRaven deployment, as well as deployment of multiple likely AI-generated tools by several big game hunting (BGH) adversaries, including a TRAVELING SPIDER INC affiliate and PUNK SPIDER, who deployed AI-generated PowerShell (PS) scripts for operations throughout late 2025 and early 2026.

Recommendations

These recommendations can be implemented to help protect against the activity described in this report:

• Consider implementing a private npm registry (where package installations can be controlled, blocked, and monitored) rather than using the official npm registry
• Configure npm to use --ignore-scripts by default, and selectively enable script execution only for trusted packages⁵
• Update npm to the latest version to restrict preinstall and postinstall script execution by default
• Educate users on dependency-confusion attacks that exploit npm’s dependency resolution to deliver malicious packages
• Use npm audit for known vulnerabilities and problems

Table 2 details the tactics and techniques described in this blog post.

Indicators of Compromise (IOCs)

Additional Resources

The post PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting appeared first on MASSIVE News.

AI is quietly reshaping writing. It’s not just that prose is changing — the very structure of written language is genuinely changing too.

It’s not just a new technology.

It’s not a fad.

It’s an undeniable revolution.

Did this article’s introduction seem AI generated? What made you feel that way?

The truth is, it was not AI generated; I wrote it to emulate synthetic prose, the kind you get when a large language model (LLM) organises words into text.

That kind of prose suddenly seems to be everywhere: on low-quality websites built to accumulate advertising clicks, in social media captions chasing engagement, and even book manuscripts. Crime novelist Jerry Falade recently lost a book deal worth more than $2 million after his own literary agents said they could no longer faithfully determine how his manuscript had come together. Hachette pulled the horror novel Shy Girl in March this year under similar suspicion.

Before generative AI, we could generally assume that written text had been composed by a human. This is no longer the case. So how can we spot AI-written text?

There is no single giveaway. Instead, there are patterns: particular words, sentence structure and expressive habits that appear repeatedly in AI-generated prose. LLMs are also updated rapidly and efficiently so what gives away synthetic text today may no longer do a few months from now.

Quiet, quietly and genuinely

The word quietly is a significant giveaway. Search interest in the word has climbed steadily on Google Trends since December 2021, though this measures searches rather than appearances in writing, so it is suggestive rather than proof.

What did change over that period is how many people began writing with the help of LLMs, and these models do seem to reach for quiet and quietly more than the average human writer.

Genuinely is a similar story, and a more anecdotal one. I notice it overused in AI output, Claude included, more than I would expect from a person writing casually. No one has run a rigorous study on that specific word yet.

The documented version of this pattern is vocabulary that has spiked in scientific writing since 2022: delve, meticulous, underscore, boast and intricate all appear far more often in scanned PubMed abstracts than before, in a pattern researchers have tied directly to ChatGPT-style phrasing.

None of these words is proof on its own. But when words like quietly, genuinely, delve and meticulous appear alongside the same polished sentence framing, it starts sounding like a shared house style among LLMs, rather than an individual voice.

A house style of its own

The “not X, but Y” construction is another part of that house style, alongside a fondness for the rule of three.

It also favours taking a modest claim and then immediately escalating it. For example: “This article presents a useful perspective on language. It fundamentally changes how we think about what it means to write”. Human writers have always used it, but generative AI produces the pattern with remarkable consistency.

Then there’s the em dash, the earliest and most mocked AI tell. It never held up particularly well. One writer ran the same prompt through six chatbots and got eight em dashes from ChatGPT in 573 words, but none from Gemini or Meta AI.

This reaffirms the lesson that, while individual clues are unreliable, their accumulation matters.

Read more:
Slanguage: Why AI’s stylistic negation — ‘it’s not X, it’s Y’ — is both annoying and doesn’t work

Lengthy text

Another clue to generative AI use is text length.

A reporter for The Atlantic describes how, after a driver crashed into her in Johannesburg, his frantic and incoherent behaviour at the scene gave way to a lengthy text written in polished prose only half an hour later. When she later contacted a mechanic whose texts had previously been filled with shorthand, his reply came back in the same distinctive AI voice.

Human language is shaped by the pressures of effort and time. Generative AI removes much of that cost. Realistically, a person might text: “Sorry, running late. Traffic is awful. Be there in 20”.

AI can swiftly turn that into a paragraph explaining the unexpected traffic congestion, expressing sincere regret and thanking the recipient for their patience. Nothing in that longer version is necessarily wrong. It’s simply doing far more linguistic work than the situation generally requires when time is of the essence.

The dangers of AI detection

Some people believe AI detection software can identify AI-generated text. However, these systems are far from perfect and can worsen existing biases.

A 2023 Stanford study found that seven popular AI detectors falsely identified an average of 61% of essays written by non-native English speakers as AI generated, with one tool flagging 97% of them.

AI detection has evolved since then, and more recent research presents a more complicated picture: current detectors can perform better in some settings, yet remain vulnerable to evasion and still produce false positives.

At the same time, the question is shifting beyond detection altogether: the European Union is now demanding that all AI-generated content is labelled or watermarked.

Are LLMs changing the way we write?

A new study in Nature Human Behaviour, analysing more than 880,000 Reddit posts, news articles and academic pieces, found that the spread of LLMs was associated with less variation in writing style.

Knowing who wrote something matters because language lands differently depending on who it comes from. Is the person trustworthy? Knowledgeable? Funny? Younger? Are they real?

The other reason is dexterity. Humans are excellent at problem solving and creativity, and those abilities appear in the peculiarities of individual language: an unexpected word, a unique comparison, a sentence structure that may reappear across writers but not en masse, as is the case with synthetic text.

If the prose across our media begins to sound as though it has been cut from the same automatic, uncreative, underwhelming and repetitive mould, we lose individuality, nuance, and our trust in the authenticity of the written text and its writer.

The post Can you teach yourself to detect AI writing? Maybe appeared first on MASSIVE News.

Every security alert begins with a deceptively simple question: Is this a real threat or just noise? Detection triage sits at the front of the response lifecycle, where answering this question quickly and accurately can determine what gets investigated, prioritized, or safely closed.

CrowdStrike’s NVIDIA Nemotron-powered detection triage models already answer this question at machine speed, reading a detection and producing a true positive (TP) or false positive (FP) verdict with a calibrated confidence score. But experienced analysts do more than arrive at a verdict. They reason toward weighing evidence across command lines, behavioral context, and other signals to understand not only what happened, but why it matters. 

So we taught our triage model to do the same. Our latest research paper, “Cybersecurity Detection Classification with Reasoning-enabled Language Models” (Khanna et al., July 2026) which supports the Open Secure AI Alliance, trains a CrowdStrike Charlotte AI™ triage classifier to reason through a detection step by step, and produce a transparent chain of reasoning, before it commits to a verdict. The result is more accurate triage, more detections that can be safely automated, and a rationale that SOC analysts can read, evaluate, and trust.

Below are the broader lessons from our findings:

• Reasoning makes triage better and more transparent: Teaching the model to think through a detection improves accuracy while producing an auditable rationale that analysts can evaluate.
• More automation is done safely: Large gains in high-confidence recall mean more benign alerts are auto-closed and more real threats can be prioritized for analysts, directly reducing alert fatigue.
• Specialization beats scale: A fine-tuned Nemotron 3 Nano 30B-A3B open model outperforms frontier general-purpose models many times its size on this task. (See figure 2)
• The agentic SOC keeps advancing: This research, currently focused on Windows endpoint detections, points to where our NVIDIA Nemotron 3 Nano 30B-A3B-powered triage is headed next, with more platforms to follow.

From Labels to Reasoning

The conventional approach to LLM-based triage asks the model to read a detection and output a label directly. This is fast and scalable, and produces a usable confidence score; however, it treats a reasoning-driven task as an instinctive response.

Chain-of-thought reasoning changes that. Before deciding, the model works through the evidence in the detection: what the process is doing, where it came from, whether the parent-child process chain looks legitimate, and how the pieces fit together. This reasoning trace empowers better verdicts and provides an auditable explanation that an analyst can review, turning an opaque label into a decision they can stand behind.

How We Trained the Model to Reason

Getting a model to reason well about real detections took a four-stage training recipe, each stage building on the last:

1. Prompt optimization: We automatically searched for the strongest possible reasoning prompt rather than hand-writing one. Crucially, we guarded the search with an LLM judge that rewarded genuine multi-field reasoning, preventing the model from collapsing into brittle numeric shortcuts that score well but don’t generalize or explain anything useful.
2. Self-training: The model learned from its own best work. It generated reasoning traces, kept the ones that reached the correct verdict, and fine-tuned them, concentrating its effort on the hardest detections it hadn’t yet mastered.
3. Reinforcement learning with verifiable rewards: Because a triage verdict is either right or wrong, we could reward the model directly for correct, well-formed answers. This allows it to discover better reasoning strategies on its own. Notably, it became both more accurate and more concise, reasoning in fewer tokens over the course of training.
4. Confidence calibration: Reasoning introduces a subtle problem: Once the model has argued its way to a conclusion, its final label token is nearly always near-certain, so the token’s probability is no longer a trustworthy confidence signal. We solved this by training a separate calibrator that reads the full reasoning trace and estimates the probability that the verdict is correct, restoring the reliable confidence score that automated triage depends on.

Results

The payoff shows up where it matters most: at the high-confidence operating point that governs automated triage. At this tier, detections can be auto-closed or prioritized with minimal analyst intervention, so higher recall here translates directly into more workload removed from the queue. Compared to the direct-label approach, the reasoning-enabled system surfaces dramatically more actionable detections at the same high precision.

This 43.0 percentage point increase in high-confidence false positive recall means far more benign alerts can be automatically and safely closed, while the 18.3 percentage point gain in true positive recall means more genuine threats can be prioritized for analysts.

Just as striking is what delivers this performance. The reasoning system reaches 82.6% overall accuracy, well above every off-the-shelf model we tested, including frontier general-purpose models many times its size. In our comparisons, leading general-purpose models clustered around 55% to 71% accuracy on this task, roughly in line with an untrained NVIDIA Nemotron 3 Nano 30B-A3B model and well below the fine-tuned result.

The post Teaching AI to Reason Through Detection Triage appeared first on MASSIVE News.