Loading story…
Attackers compromised a tech-sector organization's Linux host by exploiting CVE-2025-55182 ("React2Shell") in a vulnerable Next.js 15.4.6 and React 19.1.0 application, then used the access for overlapping malicious operations. Huntress linked the intrusion and later reinfection to multiple actor clusters: one ran a Monero miner disguised as /var/tmp/systemd-logind and mining to 62.60.246[.]210:443, another deployed a multi-revenue botnet using XMRig, EarnFM, and Repocket, and a third harvested credentials and conducted broad data exfiltration. The attackers also established eight persistence mechanisms, attempted to disable the Huntress agent, and wiped logs to hinder investigation.
The incident was complicated because the system's legitimate user, a developer, was actively using OpenAI Codex for software development and to troubleshoot suspicious behavior on the same host. Huntress found that some commands initially flagged as suspicious were actually AI-generated administrative actions, while the real compromise included theft of SSH keys, cloud credentials, API tokens, shell history, and system metadata. The case showed that AI-assisted remediation can reduce visible symptoms without removing root cause, and that human-led DFIR and continuous EDR telemetry were necessary to separate legitimate automation from attacker activity and uncover the full scope of the breach.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
In a second write-up, Huntress expanded the case with a three-actor breakdown, persistence details, exfiltration findings, and its assessment that CVE-2025-55182 exploitation likely drove the intrusion and reinfection. The follow-up also highlighted the limits of AI-assisted remediation without continuous EDR telemetry and human oversight.
Across the compromise, attackers created eight persistence mechanisms, attempted to disable the Huntress agent, and wiped logs. These actions helped maintain access and hinder investigation and remediation.
Huntress assessed the initial intrusion, and a later reinfection, as consistent with exploitation of CVE-2025-55182 ("React2Shell") against the victim organization's Next.js 15.4.6 and React 19.1.0 application. Multiple threat actors subsequently operated on the same host.
Huntress publicly described the Linux incident and explained how legitimate Codex activity initially masked symptoms and complicated SOC triage alongside real attacker behavior. The write-up emphasized the need for human analysts to distinguish AI-assisted user actions from malicious activity.
Huntress found evidence of credential harvesting and exfiltration of sensitive materials including SSH keys, cloud credentials, API tokens, shell history, and system metadata. The incident involved both theft of secrets and broader data exfiltration from the compromised host.
Analysts determined the host was affected by at least three distinct activity clusters: a cryptominer operator, a botnet operator deploying XMRig, EarnFM, and Repocket with persistence, and a third actor conducting credential harvesting and mass data exfiltration. This separated legitimate Codex activity from real malicious actions on the system.
The legitimate user of the compromised host used OpenAI Codex both for software development and to troubleshoot suspicious system behavior. Some AI-generated commands resembled attacker tradecraft, creating substantial noise during SOC triage.
A Monero cryptominer running as /var/tmp/systemd-logind was active since boot on the affected Linux endpoint. Huntress observed it mining to 62.60.246[.]210:443.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported an active campaign exploiting **React2Shell** (`CVE-2025-55182`) in React.js and Next.js server components to achieve remote code execution and deploy **XMRig** for Monero mining. Darktrace observed the activity through its **CloudyPots** honeypot network, where an attacker abused an exposed, unauthenticated Docker daemon to launch a container, install utilities, retrieve Python components from Pastebin and a GitHub Gist, and validate exploitation with commands such as: ```bash whoami wget ``` The exploit chain used crafted Next.js server component payloads to trigger exceptions and leak command output, enabling shell execution on vulnerable targets.
Jul 9, 2026
Cisco Talos reported that threat cluster **UAT-10608** exploited the critical Next.js **React2Shell** vulnerability, tracked as **`CVE-2025-55182`** with a **CVSS 10.0**, to compromise at least **766 internet-exposed hosts** across multiple regions and cloud providers. The campaign appears to be broad and automated, with attackers likely using internet-scanning services to find vulnerable deployments before gaining remote code execution and installing a dropper plus a multi-stage credential-harvesting framework called **NEXUS Listener**. Investigators said the malware collected secrets from files, cloud settings, system memory, shell history, containers, and SSH material, then exposed the loot through a password-protected web dashboard that allowed operators to browse victims and search stolen data. Observed data included **AWS credentials, private SSH keys, database connection strings, GitHub and GitLab tokens, Stripe keys, SendGrid and Brevo secrets, Telegram bot tokens, and credentials for OpenAI, Anthropic, and NVIDIA NIM**, raising risks of cloud takeover, lateral movement, software supply chain abuse, follow-on intrusions, and resale of access; defenders were urged to patch vulnerable Next.js systems, rotate exposed credentials, restrict metadata service access, and monitor for suspicious background processes.
Jun 29, 2026
Attackers rapidly weaponized **React2Shell** (`CVE-2025-55182`), a critical flaw in React Server Components and React/Next.js applications that enables unauthenticated remote code execution. Security reporting described the bug as one of the most consequential vulnerabilities of the year, with exploitation spreading across criminal and state-linked operations and defenders urged to prioritize emergency patching and monitoring. The flaw was also tied to broader shifts in the threat landscape, including more resilient malware campaigns, cloud-focused intrusions, and increasingly AI-enabled attack activity. Large-scale exploitation followed disclosure, with more than **8.1 million attack sessions** observed from over **8,000 unique source IPs** spanning **101 countries**, including substantial traffic routed through major cloud providers such as AWS. Researchers also linked the vulnerability to follow-on malware activity, including the **EtherRAT** campaign, which used Ethereum smart contracts for command-and-control, while reporting highlighted advanced evasion methods such as AMSI bypass and rapid IP rotation that reduced the effectiveness of static defenses. The volume and sophistication of the attacks underscored the need for behavioral detection, dynamic threat intelligence, and immediate remediation of exposed internet-facing systems.
Jul 9, 2026