Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

A large-scale credential harvesting campaign is targeting Next.js hosts via exploitation of the React2Shell vulnerability (CVE-2025-55182). Attackers are stealing sensitive credentials including database credentials, SSH private keys, AWS secrets, Stripe API keys, and GitHub tokens from approximately 766 compromised hosts. The operation, attributed to a threat cluster tracked by Cisco Talos, leverages the vulnerability as an initial access vector to perform credential theft at scale. Organizations running vulnerable Next.js deployments should apply patches immediately, rotate potentially compromised credentials, and audit cloud service configurations to detect unauthorized access.

A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services (AWS) secrets, shell command history, Stripe API keys, and GitHub tokens at scale. Cisco Talos has attributed the operation to a threat cluster it tracks as

A large-scale credential harvesting campaign is targeting Next.js hosts via exploitation of the React2Shell vulnerability (CVE-2025-55182). Attackers are stealing sensitive credentials including database credentials, SSH private keys, AWS secrets, Stripe API keys, and GitHub tokens from approximately 766 compromised hosts. The operation, attributed to a threat cluster tracked by Cisco Talos, leverages the vulnerability as an initial access vector to perform credential theft at scale. Organizations running vulnerable Next.js deployments should apply patches immediately, rotate potentially compromised credentials, and audit cloud service configurations to detect unauthorized access. A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services (AWS) secrets, shell command history, Stripe API keys, and GitHub tokens at scale. Cisco Talos has attributed the operation to a threat cluster it tracks as A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services (AWS) secrets, shell command history, Stripe API keys, and GitHub tokens at scale. Cisco Talos has attributed the operation to a threat cluster it tracks as