Overview
A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services (AWS) secrets, shell command history, Stripe API keys, and GitHub tokens at scale. Cisco Talos has attributed the operation to a threat cluster it tracks as
Vulnerability Details
- CVE-2025-55182: Referenced in source reporting from thehackernews.
Organisations Involved
The following organisations are mentioned in relation to this incident: AWS, Amazon, Amazon Web Services, Cisco, Cisco Talos, GitHub.
Sources: thehackernews. Aggregated by Cybernews Agency pipeline.