Pcp Cat

PCP Cat is a threat actor associated with a large-scale credential theft campaign targeting exposed Next.js servers. The group has been linked to rapid mass exploitation of critical Next.js vulnerabilities, including CVE-2025-29927 and CVE-2025-66478, to obtain remote code execution on internet-facing systems. Reported tradecraft includes broad scanning of public-facing applications, exploitation of vulnerable web services, validation of code execution, harvesting of sensitive secrets from compromised hosts, and installation of persistence and tunneling components to retain access and enable follow-on operations. Observed post-compromise activity includes theft of environment secrets, SSH material, cloud configuration data, container-related credentials, source-control credentials, and shell history, indicating a strong focus on credential access and downstream account compromise. PCP Cat has also been associated with deployment of proxying and reverse-tunneling tooling, creation of persistent services, and abuse of exposed Docker management interfaces for persistence and pivoting. The actor has used malware referred to as react.py to distribute scanners and support exploitation at scale. The campaign has been publicly associated with Telegram-based branding and coordination under the PCP Cat name. Available reporting supports financially motivated operations centered on credential harvesting, cloud account takeover, and potential resale of stolen access. High-confidence behaviors include reconnaissance and scanning, initial access through exploitation of public-facing applications, credential theft, exfiltration, persistence, lateral or network pivot enablement through tunneling, and broader post-exploitation activity.