Malware & Threats React2Shell Exploited in Large-Scale Credential Harvesting Campaign Using automated scanning and the Nexus Listener collection framework, the hackers compromised over 750 systems. Ionut ArghireApril 3, 2026
Vulnerabilities Cryptominers, Reverse Shells Dropped in Recent React2Shell Attacks Two IP addresses accounted for the majority of the 1.4 million exploitation attempts observed over the past week. Ionut ArghireFebruary 4, 2026
Malware & Threats RondoDox Botnet Exploiting React2Shell Vulnerability In December, the botnet’s operators focused on weaponizing the flaw to compromise vulnerable Next.js servers. Ionut ArghireJanuary 2, 2026
Malware & Threats Google Sees 5 Chinese Groups Exploiting React2Shell for Malware Delivery Google has also mentioned seeing React2Shell attacks conducted by Iranian threat actors. Eduard KovacsDecember 15, 2025
Malware & Threats Wide Range of Malware Delivered in React2Shell Attacks Security firms have seen cryptocurrency miners, Linux backdoors, botnet malware, and various post-exploitation implants in React2Shell attacks. Eduard KovacsDecember 11, 2025
Malware & Threats React2Shell Attacks Linked to North Korean Hackers North Korean threat actors are believed to be behind CVE-2025-55182 exploitation delivering EtherRAT. Eduard KovacsDecember 9, 2025
Vulnerabilities Exploitation of React2Shell Surges An increasing number of threat actors have been attempting to exploit the React vulnerability CVE-2025-55182 in their attacks. Eduard KovacsDecember 8, 2025
Incident Response Cloudflare Outage Caused by React2Shell Mitigations The critical React vulnerability has been exploited in the wild by Chinese and other threat actors. Eduard KovacsDecember 5, 2025
Vulnerabilities Chinese Hackers Exploiting React2Shell Vulnerability AWS has seen multiple China-linked threat groups attempting to exploit the React vulnerability CVE-2025-55182. Eduard KovacsDecember 5, 2025