Loading story…
Security researchers reported an active campaign exploiting React2Shell (CVE-2025-55182) in React.js and Next.js server components to achieve remote code execution and deploy XMRig for Monero mining. Darktrace observed the activity through its CloudyPots honeypot network, where an attacker abused an exposed, unauthenticated Docker daemon to launch a container, install utilities, retrieve Python components from Pastebin and a GitHub Gist, and validate exploitation with commands such as:
whoami
wget
The exploit chain used crafted Next.js server component payloads to trigger exceptions and leak command output, enabling shell execution on vulnerable targets.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Using public mining-pool statistics, researchers estimated the React2Shell cryptojacking operation infected about 91 hosts. Despite that reach, the campaign earned only about 0.015 XMR, roughly £5 or $5.02.
Researchers assessed the React2Shell payload as AI-generated based on unusually verbose comments, an educational-use disclaimer, and GPTZero analysis estimating 76% of the code was AI-generated. The finding highlighted how LLMs can accelerate creation of functional exploitation tooling.
Darktrace detected an active campaign in its CloudyPots honeypot network exploiting React2Shell (CVE-2025-55182) through an exposed Docker daemon. The attacker spawned a malicious container, validated code execution, and used a Python exploit chain to deploy XMRig for Monero mining.
Ontinue analysts described VoidLink as a modular Linux malware framework targeting cloud and enterprise environments, with credential theft, cloud metadata probing, container and Kubernetes targeting, and kernel-level stealth. The report also noted signs the malware was built with assistance from an LLM coding agent.
Malicious versions of the official dYdX client libraries were published simultaneously to npm and PyPI, indicating likely compromise of maintainer publishing credentials. The npm package stole wallet seed phrases and device fingerprints, while the PyPI package also deployed a remote access trojan capable of arbitrary code execution.
In preparation for the dYdX supply-chain attack, the attacker registered the typosquatting domain dydx[.]priceoracle[.]site, which was later used to receive exfiltrated wallet seed phrases.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcegovinfosecurity.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are actively exploiting **React2Shell**, a critical remote code execution flaw in React Server Components tracked as `CVE-2025-55182`, with related exposure also noted in Next.js as `CVE-2025-66478`. The bug stems from insecure deserialization in the React Server Components Flight protocol and allows unauthenticated attackers to upload malicious payloads and execute arbitrary code on vulnerable internet-facing servers. Public disclosure was quickly followed by advisories, proof-of-concept code, and reports of broad exploitation, while Microsoft and other researchers said hundreds of machines had already been hacked. Follow-on campaigns have been widespread and largely opportunistic, ranging from credential-harvesting operations to malware deployment against organizations in multiple sectors and regions. Cisco Talos-linked reporting said at least **766 servers** were compromised by an automated campaign that stole SSH keys, cloud tokens, API keys, Kubernetes and GitHub credentials, Docker metadata, and other environment secrets, including keys tied to AI platforms and payment services. Other investigations tied exploitation to **XMRig**, **RustoBot**, **Kaiji**, **Sliver**, **CrossC2**, **Tactical RMM**, **VShell**, and **EtherRAT**, along with persistence, reconnaissance, DNS-based exfiltration, and SSH key installation, underscoring how rapidly the vulnerability was weaponized after disclosure.
Aug 15, 2026
Threat actors are actively exploiting **React2Shell** (**CVE-2025-55182**), a critical remote code execution flaw in the Flight protocol used for client-server communication in **React Server Components**. The issue is attributed to **insecure deserialization** that can allow unauthorized code execution on vulnerable servers, with observed targeting across insurance, e-commerce, and IT organizations. Reported payloads include the **XMRig** cryptocurrency miner as well as multiple botnets and remote access tooling; campaigns observed against Russian entities deployed **RustoBot** and **Kaiji**, while other activity distributed malware such as **CrossC2**, **Tactical RMM**, **VShell**, and **EtherRAT**. Affected packages include `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in versions **19.0**, **19.1.0**, **19.1.1**, and **19.2.0**, with fixes available in **19.0.1**, **19.1.2**, and **19.2.1**. Separate reporting highlighted that attackers leveraged a **public proof-of-concept (PoC)** for React2Shell and began targeting organizations within hours, reinforcing that rapid weaponization is now common; defenders are advised to patch and also perform post-patch validation, including checking for indicators of compromise, verifying *Next.js* and dependency versions, rebuilding projects after updates, and confirming lockfiles no longer reference vulnerable package versions.
Jun 29, 2026
A GitHub repository masquerading as a vulnerability scanner for CVE-2025-55182, also known as React2Shell, was discovered to be distributing malware instead of providing legitimate security functionality. The tool, named React2shell-scanner and hosted by the user niha0wa, embedded a hidden payload within its code that executed a PowerShell command via mshta.exe to download additional malicious scripts from a remote server. This attack specifically targeted security professionals and researchers investigating the React2Shell vulnerability, leveraging their trust in open-source platforms to compromise Windows devices. GitHub responded by removing the repository after community reports and warnings from cybersecurity researchers. Simultaneously, attackers have been actively exploiting the React2Shell vulnerability in the wild, particularly targeting Japanese organizations. Initial exploitation campaigns deployed cryptocurrency miners, but more recent attacks have introduced a sophisticated remote access trojan named ZnDoor. This malware is delivered through shell commands executed after successful exploitation of CVE-2025-55182, establishing persistent backdoor access and encrypted command and control communications. The emergence of ZnDoor marks a significant escalation in the threat landscape for organizations using vulnerable React/Next.js applications, highlighting the dual risks of both malicious "security" tools and direct exploitation by advanced malware.
Jun 29, 2026