A widespread hacking campaign is underway, utilizing automation to pilfer login details by exploiting a React2Shell vulnerability (CVE-2025-55182) in susceptible Next.js applications.

Compromised systems, numbering at least 766 and spanning multiple cloud providers and regions, are being used to gather sensitive information like database logins, AWS credentials, private SSH keys, API keys, cloud access tokens, and environment secrets.

This operation uses a tool called NEXUS Listener and relies on automated scripts to pull out and transmit sensitive information from various applications.

Cisco Talos attributes this activity to a threat actor group named UAT-10608. Researchers were able to access a publicly exposed NEXUS Listener instance, which allowed them to analyze the types of information being collected from affected systems and understand how the web application functions.

The attacks start with automated scans seeking out vulnerable Next.js applications. When found, the React2Shell flaw is used to gain access. A script designed to execute a multi-stage credential-harvesting process is then placed in the standard temporary directory.

According to Cisco Talos researchers, the following information has been compromised:

• Environment settings and secrets (including API keys, database passwords, and GitHub/GitLab tokens)
• SSH keys
• Cloud credentials (AWS/GCP/Azure metadata and IAM credentials)
• Kubernetes tokens
• Docker/container details
• Command history
• Process and runtime data

The stolen data is sent out in small pieces via HTTP requests over port 8080 to a central server (C2) running the NEXUS Listener software. The attacker then receives a detailed overview of the stolen data, complete with search, filtering, and statistical analysis capabilities.

“The application displays various statistics, including the number of affected hosts and the total count of each type of credential successfully harvested from those hosts,” Cisco Talos stated in a recent report.

“It also displays the application’s operational time. In this scenario, the automated attack and data collection system successfully compromised 766 hosts within a 24-hour timeframe.”

The stolen credentials give attackers the ability to take over cloud accounts and access databases, payment systems, and other sensitive services. This could also lead to supply chain attacks. Stolen SSH keys could allow for lateral movement within compromised networks.

Cisco emphasizes that the data compromised, including private details, makes affected organizations vulnerable to lawsuits related to privacy law breaches.

The researchers advise system administrators to implement the security patches for React2Shell, review their server-side data exposure, and immediately change all login credentials if they suspect a compromise.

They also suggest enforcing AWS IMDSv2 and replacing any reused SSH keys. Furthermore, they recommend enabling secret scanning, implementing WAF/RASP protections for Next.js, and enforcing the principle of least privilege across all containers and cloud roles to minimize potential damage.