Loading story…
A large-scale credential theft campaign, identified as PCPcat, compromised over 59,000 publicly exposed Next.js servers within a 48-hour period. Attackers exploited critical remote code execution vulnerabilities, specifically CVE-2025-29927 and CVE-2025-66478, using a custom malware (react.py) to scan and infiltrate targets. Once access was gained, the attackers extracted sensitive credentials from .env files, SSH keys, AWS configurations, Docker tokens, and Git credentials, and established persistent access through the installation of proxy and tunneling tools such as GOST SOCKS5 and FRP. The campaign's command-and-control infrastructure was exposed, revealing operational statistics and methods for target assignment, data exfiltration, and health checks, with key indicators of compromise including specific IP addresses, files, processes, and log artifacts.
The operation was attributed to the group "PCP Cat," with evidence of their activity and communication channels found on Telegram. Security researchers provided detection rules for Suricata and YARA to identify malicious activity related to this campaign. The scale and speed of the attack, affecting over 59,000 servers in less than two days, highlight the critical need for organizations using Next.js to patch vulnerable systems and monitor for signs of compromise, especially given the attackers' use of prototype pollution and Docker API abuse for persistence and lateral movement.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
By 2025-12-24, reporting said the campaign's command-and-control infrastructure had been exposed, revealing operational details, indicators of compromise, and attribution to the 'PCP Cat' group. Researchers also published recommended mitigations including urgent patching, key rotation, C2 blocking, and monitoring, along with Suricata and YARA detection rules.
After compromising servers, the operators used react.py malware to steal sensitive credentials and install persistent proxy and tunneling services on affected systems. Reporting indicated the exposed infrastructure suggested a very high compromise rate and projected more than 300,000 credentials could be harvested.
Within a 48-hour period ending around 2025-12-24, attackers in the PCPcat campaign compromised roughly 59,000 to 60,000 internet-exposed Next.js/React servers. The operation reportedly exploited CVE-2025-29927 and CVE-2025-66478 to gain remote code execution at scale.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution vulnerability, CVE-2025-55182, was discovered in Next.js 13+ and React Server Components, allowing attackers to execute arbitrary code via a deserialization flaw in the Server Actions feature. Following the public disclosure, multiple attack campaigns exploited this vulnerability, resulting in widespread compromises, including the deployment of cryptocurrency miners, persistent malware, and advanced implants such as EtherRAT, which leverages Ethereum smart contracts for command and control. Security researchers and developers responded by analyzing the technical root cause of the vulnerability, documenting real-world exploitation, and developing tools to detect and remediate infections that persist after patching. Notably, new forensic tools were released to scan for indicators of compromise left behind by attackers, including fake services, malicious cron jobs, and unauthorized system modifications. The sophistication of some payloads, such as EtherRAT, suggests involvement from advanced threat actors, including DPRK-linked groups, and highlights the need for comprehensive post-patch incident response for affected environments.
Jun 29, 2026
Cisco Talos reported that threat cluster **UAT-10608** exploited the critical Next.js **React2Shell** vulnerability, tracked as **`CVE-2025-55182`** with a **CVSS 10.0**, to compromise at least **766 internet-exposed hosts** across multiple regions and cloud providers. The campaign appears to be broad and automated, with attackers likely using internet-scanning services to find vulnerable deployments before gaining remote code execution and installing a dropper plus a multi-stage credential-harvesting framework called **NEXUS Listener**. Investigators said the malware collected secrets from files, cloud settings, system memory, shell history, containers, and SSH material, then exposed the loot through a password-protected web dashboard that allowed operators to browse victims and search stolen data. Observed data included **AWS credentials, private SSH keys, database connection strings, GitHub and GitLab tokens, Stripe keys, SendGrid and Brevo secrets, Telegram bot tokens, and credentials for OpenAI, Anthropic, and NVIDIA NIM**, raising risks of cloud takeover, lateral movement, software supply chain abuse, follow-on intrusions, and resale of access; defenders were urged to patch vulnerable Next.js systems, rotate exposed credentials, restrict metadata service access, and monitor for suspicious background processes.
Jun 29, 2026
Researchers linked **TeamPCP** to multiple interconnected intrusion campaigns spanning web application exploitation, software supply-chain abuse, and infrastructure hijacking. Reporting on the **Operation PCPcat** and **React2Shell** activity said attackers exploited vulnerable **Next.js** deployments and compromised roughly **59,000 servers**, using them to steal credentials and build follow-on access. Separate investigations into the **CanisterWorm** campaign found dozens of malicious **npm** packages carrying hidden `postinstall` scripts that stole npm tokens from `.npmrc`, `/etc/npmrc`, and environment variables, then republished trojanized updates through victims’ own publisher accounts. The malware also established Linux persistence with a masqueraded user-level `systemd` service named **`pgmon`** and fetched later-stage payloads through **Internet Computer** canister infrastructure, complicating takedown efforts. Additional reporting tied the broader operation to compromised CI/CD ecosystems, residential proxy building, and ransomware monetization. An investigation into the **Xygeni GitHub Action** compromise found the same custom **ShadowLink** backdoor protocol used in malware that exploited **TP-Link** and **ASUS** routers, including abuse of **`CVE-2024-21833`** to install **microsocks** and maintain SOCKS5 proxy persistence via cron, `rc.local`, and NVRAM changes; researchers said this strongly links the router campaign to the Xygeni intrusion, while overlap with TeamPCP remains partly circumstantial. By late March, defenders reported TeamPCP had slowed new package compromises and shifted toward monetization through harvested credentials and dual ransomware tracks, including its own **CipherForce** operation and activity aligned with the **Vect** ransomware ecosystem; related fallout included **ownCloud** disclosing build infrastructure exposure through **`CVE-2026-33634`** associated with the Trivy compromise.
Jun 29, 2026