Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials
Overview
A significant credential harvesting campaign has been detected, utilizing the React2Shell vulnerability (CVE-2025-55182) to gain access to sensitive data from 766 Next.js hosts. Attackers are stealing various credentials, including database logins, SSH private keys, AWS secrets, Stripe API keys, and GitHub tokens. This operation has been linked to a threat group that Cisco Talos is monitoring. The widespread nature of this breach is concerning, as it affects a range of developers and companies using Next.js, potentially compromising their applications and user data. Companies need to be vigilant and take immediate steps to secure their systems against this threat.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Next.js hosts, database credentials, SSH private keys, Amazon Web Services (AWS) secrets, Stripe API keys, GitHub tokens.
- Action Required: Organizations should patch their systems to address the React2Shell vulnerability (CVE-2025-55182) and implement security best practices such as limiting access to sensitive credentials, regularly rotating keys and secrets, and monitoring for unauthorized access attempts.
- Timeline: Newly disclosed
Original Article Summary
A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services (AWS) secrets, shell command history, Stripe API keys, and GitHub tokens at scale. Cisco Talos has attributed the operation to a threat cluster it tracks as
Impact
Next.js hosts, database credentials, SSH private keys, Amazon Web Services (AWS) secrets, Stripe API keys, GitHub tokens.
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Newly disclosed
Remediation
Organizations should patch their systems to address the React2Shell vulnerability (CVE-2025-55182) and implement security best practices such as limiting access to sensitive credentials, regularly rotating keys and secrets, and monitoring for unauthorized access attempts.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to CVE, Cisco, Exploit, and 2 more.
Multiple Sources: This threat is being reported by 3 different security sources, indicating significant concern within the cybersecurity community.