Bissa scanner

Each line distilled the victim’s identity, runtime context, privilege level, cloud posture, and recoverable secret surface into a single at-a-glance record, allowing the operator to triage hundreds of exploitation events directly from Telegram.

the threat actor used a combination of Claude Code and OpenClaw as an attack orchestration tool to automate large-scale scanning that exploited a vulnerability in the Next.js framework

Data stolen included credentials from AI platforms such as Anthropic, OpenAI, Google, AWS, Stripe, PayPal, and others

automate large-scale scanning that exploited a vulnerability in the Next.js framework (CVE-2025-55182)

The scanner also includes a dedicated WordPress module targeting CVE-2025-9501, an unauthenticated command injection in the W3 Total Cache plugin (versions prior to 2.8.13, CVSS 9.0).

Artifacts on the host showed that React2Shell (CVE-2025-55182) was central to the operation. The workflow appeared capable of scanning millions of internet-facing targets, with logs indicating more than 900 confirmed compromises.

Data stolen included credentials from AI platforms such as Anthropic, OpenAI, Google, AWS, Stripe, PayPal, and others

Data stolen included credentials from AI platforms such as Anthropic, OpenAI, Google, AWS, Stripe, PayPal, and others

Data stolen included credentials from AI platforms such as Anthropic, OpenAI, Google, AWS, Stripe, PayPal, and others

That staged dataset included Plaid tokens, linked bank-account data, IRS transcript material, ACH-related records, Twilio calls, Salesforce contacts, and case data containing SSN and DOB fields.

The scanner was configured to watch its local results/ directory, batch *.env files into ZIPs, and upload them to hxxps://s3.filebase[.]com in bucket bissapromax under the archives/ prefix.

Bissa harvested .env files specifically for AI provider credentials (Anthropic, OpenAI, Groq, Mistral, OpenRouter, HuggingFace, Replicate, DeepSeek).

Across tens of thousands of .env files, the attacker collected keys and tokens for AI providers like Anthropic and OpenAI, cloud platforms including AWS and Azure, payment systems like Stripe and PayPal, and databases such as MongoDB and Supabase.

Bissa is a modular mass-exploitation platform built around React2Shell (CVE-2025-55182), with 900+ confirmed compromises across millions of scanned Next.js endpoints

The scanner relies on an acquirer file containing targets and a lease file defining the exploit type... deploying a payload intended to enumerate .env files, cloud metadata, Kubernetes service account context, local credential stores, database and Redis access, cryptocurrency wallet material, and other high-value secrets.

This flaw allowed attackers to target millions of web servers and pull out sensitive environment files (.env) that often contain passwords, API keys, and access tokens.

Researchers noted that the contents were far from a simple data dump. Instead, the server showed a professionally organized operation with scripts for exploitation, victim-data staging, credential harvesting, and access validation all running in one place.

Runner scripts inside the Bissa scanner framework were hardcoded with a Telegram bot token linked to a bot called @bissapwned_bot. Every time the scanner confirmed a successful React2Shell exploit, the bot sent a structured alert directly to the attacker’s private Telegram chat.

Data stolen included credentials from AI platforms such as Anthropic, OpenAI, Google, AWS, Stripe, PayPal, and others, as well as cloud, payment, and database files

Between April 10 and April 21, 2026, the operator uploaded over 65,000 archived file entries to a cloud storage bucket called “bissapromax” using S3-compatible Filebase, showing just how automated and continuous the collection pipeline was.