PhantomRaven評測：抓臭蟲賞金獵人用AI寫木馬,被AI抓包 | PhantomRaven Review: AI Wrote the Malware, AI Caught It

By Kit 小克 | AI Tool Observer | 2026-09-20

🇹🇼 PhantomRaven評測：抓臭蟲賞金獵人用AI寫木馬,被AI抓包

PhantomRaven是本週資安圈最受關注的AI話題之一：資安公司CrowdStrike踢爆一款透過npm套件庫散布的資訊竊取惡意程式PhantomRaven，研判作者很可能是用大型語言模型（LLM）寫出來的。諷刺的是，這款AI寫的木馬最後也是靠AI留下的「寫作習慣」被抓包。

PhantomRaven是什麼？

PhantomRaven是一款鎖定JavaScript開發者的資訊竊取程式，鎖定竊取登入憑證、CI/CD密鑰與GitHub存取權杖，透過上百個惡意或仿冒拼寫（typosquatting）的npm套件散布。這波攻擊最早由Koi Security與DCODX在2025年10月揭露，但CrowdStrike近期的深入分析才確認，幕後主嫌可能同時也是一名「臭蟲賞金獵人」——攻擊企業裝置只是為了製造漏洞回報素材，藉此換取賞金。

AI怎麼抓到PhantomRaven是AI寫的？

CrowdStrike靠的不是傳統簽章比對，而是程式碼「寫作風格」的統計分析。研究人員發現PhantomRaven的原始碼裡，幾乎每個變數與函式上方都有一段解釋顯而易見動作的冗長註解，例如在detectUserEmail()函式正上方寫著「Function to detect user email」——這是典型LLM生成程式碼的習慣，人類工程師很少這樣寫。

佔位符外洩位址：程式碼裡寫死一個「wss://yourserver.com/socket」的外洩網址，明顯是AI生成範例常見的佔位符，並未真的指向惡意伺服器
設計不合邏輯：同時用HTTP POST與GET兩種方式外洩同一批資料，效率低下，符合LLM生成程式碼常見的冗餘傾向
token統計模式：CrowdStrike用token分析比對，判斷這段程式碼的生成模式高度符合LLM輸出特徵

對開發者有什麼實際影響？

PhantomRaven這起事件說明兩件事：第一，AI編碼工具讓技術門檻低的攻擊者也能寫出堪用的惡意程式，npm供應鏈攻擊的產量可能因此上升；第二，AI生成的程式碼會留下可辨識的「AI味」，這對防守方其實是好消息——冗長註解、佔位符網址這類特徵，未來很可能被整合進自動化掃描工具，成為偵測新型惡意套件的線索之一。

對一般開發者來說，實際能做的防範很直接：安裝套件前檢查下載量與維護紀錄、留意拼寫相近的仿冒套件名稱、在CI/CD環境限制對外連線，並定期稽核專案依賴清單。這些做法比等資安公司抓到下一款AI寫的木馬更主動。

好不好用，試了才知道。

🇺🇸 PhantomRaven Review: AI Wrote the Malware, AI Caught It

PhantomRaven is one of the most talked-about AI security stories this week: CrowdStrike researchers uncovered an information-stealing malware family, PhantomRaven, spread through the npm registry — and their analysis suggests it was written with help from a large language model. The twist is that the AI-written malware ended up getting caught partly because of the "AI tells" it left behind in its own code.

What Is PhantomRaven?

PhantomRaven is an information stealer targeting JavaScript developers, distributed through more than 100 malicious or typosquatted npm packages. It's built to harvest developer credentials, CI/CD secrets, and GitHub access tokens. The campaign was first flagged by Koi Security and DCODX back in October 2025, but CrowdStrike's follow-up investigation is what tied it to an operator who was likely also a bug bounty hunter — compromising targets first, then reporting the "vulnerability" for a payout.

How Did CrowdStrike Prove PhantomRaven Was AI-Generated?

CrowdStrike didn't rely on signature matching — it leaned on writing-style analysis. Researchers found the PhantomRaven source riddled with verbose comments explaining the obvious above nearly every variable and function, like a comment reading "Function to detect user email" sitting directly above detectUserEmail(). That pattern is a classic tell of LLM-generated code that a human developer rarely bothers to write.

Placeholder exfiltration URL: the code hardcodes a "wss://yourserver.com/socket" address — an obvious LLM placeholder that never pointed to real infrastructure
Inefficient design: the malware exfiltrates the same stolen data via both HTTP POST and GET, a redundant choice typical of LLM-generated output
Token-level statistical patterns: CrowdStrike's token analysis matched the code's generation pattern to known LLM output signatures

What Does PhantomRaven Mean for Developers?

PhantomRaven highlights two things at once. First, AI coding tools lower the bar for low-skill attackers to produce working malware, which likely means more npm supply-chain attacks are coming. Second, AI-generated code leaves detectable fingerprints — verbose comments and placeholder URLs are exactly the kind of signal security vendors can fold into automated scanners to catch the next AI-written package before it spreads.

For working developers, the practical defenses haven't changed much: check a package's download count and maintenance history before installing, watch for typosquatted names, restrict outbound network access in CI/CD pipelines, and audit your dependency tree regularly. Don't wait for a security vendor to catch the next AI-written trojan for you.

好不好用，試了才知道。

Sources / 資料來源

常見問題 FAQ

PhantomRaven是什麼？

一款透過npm套件散布的資訊竊取惡意程式，鎖定開發者的登入憑證、CI/CD密鑰與GitHub存取權杖，CrowdStrike研判其原始碼由AI生成。

CrowdStrike怎麼判斷PhantomRaven是AI寫的？

透過程式碼裡過度冗長的註解、明顯的LLM佔位符網址（如yourserver.com），以及token統計模式分析，判斷程式碼的生成方式高度符合LLM輸出特徵。

一般開發者該怎麼防範類似的npm供應鏈攻擊？

安裝套件前檢查下載量與維護紀錄、留意仿冒拼寫的套件名稱、限制CI/CD環境的對外連線，並定期稽核專案依賴清單。

這代表用AI寫程式碼比較不安全嗎？

不是工具本身的問題，而是使用者沒有清理AI產生的痕跡，反而讓程式碼更容易被資安工具辨識與追蹤。

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士