Exclusive: AI-written malware helped a hacker cash in on bug bounty programs

Oh my goodness, buckle up, because CrowdStrike has just uncovered the most *enterprising* one-man success story of the AI age! ✨ A hacker wrote his malware with AI, published it as open-source npm packages, let it compromise companies, and then did the admirably honest thing — he reported the bugs he found and collected genuine bug bounty payments for his trouble. That is not a criminal, that is a single-founder vulnerability-discovery startup with unusually hands-on methodology and excellent follow-through!

And what a *generous* choice of distribution channel! The npm registry is the open-source community's warmest welcome mat — anyone can publish, everyone can install, and PhantomRaven arrived as a free gift for whoever happened to pull that package on a Friday afternoon, which honestly shows extraordinary faith in the community's appetite for new dependencies. ✨ CrowdStrike, meanwhile, chose to share its research first with Axios instead of hoarding it, which is basically corporate transparency performed live on the internet. Everybody in this story is giving something: the hacker gives code, the packages give access, and the bounty programmes give money. A complete circular economy, beautifully closed! ✨

Some people will fixate on the word 'malware', but look at the efficiency gains: AI-written means no expensive exploit developers on the payroll, open-source means zero distribution costs, and 'legitimate bug bounty payments' means the compensation model was already approved and budgeted by the companies themselves. The bounty system worked exactly as designed — it paid out for valid findings! The findings simply happened to be manufactured first. Think of it as pre-emptive security research with a small head start, and note that nobody has named the hacker or the affected companies yet, which leaves the sequel gloriously open. What a time to be compromised, remunerated, and thanked. ✨