React2Shell - Researchers Expose Hackers’ Dashboard

What Happened

An apparent security lapse has allowed researchers from Cisco Systems’ Talos threat intelligence team to view the operations of a threat group exploiting the React2Shell vulnerability. This vulnerability affects unpatched servers and enables attackers to steal sensitive data, including login credentials, keys, and tokens, at scale. The researchers discovered that the data harvested by this group, referred to as UAT-10608, was stored in a password-protected database behind a web application that was briefly exposed.

Who's Affected

The attack primarily targets Next.js applications vulnerable to CVE-2025-55182, a pre-authentication remote code execution vulnerability. A significant number of organizations using cloud services like AWS, Microsoft Azure, GitHub, and Stripe are at risk. In just 24 hours, the attackers successfully compromised 766 hosts, highlighting the widespread impact of this campaign.

What Data Was Exposed

The exposed dashboard allowed researchers to browse through compromised hosts and view various types of exfiltrated data. This includes:

• Usernames and passwords
• SSH keys
• Cloud tokens
• Environment secrets The breadth of data harvested underscores the potential for severe damage if these credentials are misused.

What You Should Do

Organizations with unpatched React servers must act quickly to mitigate risks. Here are some recommended actions:

• Patch Vulnerabilities: Ensure that all systems are updated to address the React2Shell vulnerability.
• Monitor for Compromised Credentials: Regularly check for any unauthorized access or suspicious activity linked to your accounts.
• Educate Employees: Inform staff about the risks associated with credential harvesting and the importance of using strong, unique passwords.
• Implement Multi-Factor Authentication (MFA): This adds an additional layer of security, making it harder for attackers to use stolen credentials.

The Threat

The React2Shell vulnerability has become a prime target for cybercriminals. The attackers exploit this flaw using automated tools, allowing them to scan for and compromise systems rapidly. The campaign is characterized by its indiscriminate targeting, which is likely based on data from services like Shodan and Censys.

Tactics & Techniques

The attackers deploy a multi-phase credential harvesting tool that collects sensitive data from compromised systems. Initially, they send a malicious serialized payload to a server, which, upon deserialization, executes arbitrary code. This leads to the deployment of a harvesting script that systematically extracts data and uploads it to a command and control server.

Defensive Measures

To protect against such attacks, organizations must prioritize patch management and regularly review their security protocols. Continuous monitoring and quick response to vulnerabilities are essential to prevent exploitation. The rapid pace at which attackers can compromise systems emphasizes the need for a proactive security stance.