Hackers Use Telegram Bots to Track 900+ Successful React2Shell Exploits

A mass exploitation campaign leveraging a critical Next.js vulnerability (CVE-2025-55182, "React2Shell") used an automated scanner called Bissa to pull .env files and sensitive credentials from internet-facing web apps; the operator automated real-time alerts via Telegram bots (@bissapwned_bot and @bissa_scan_bot) and staged harvested data in cloud storage (bissapromax), impacting hundreds of organizations and collecting tens of thousands of secrets including cloud and payment keys.