Hackers Compromised 700+ Next.js Hosts by Exploiting React2Shell Vulnerability

Cisco Talos researchers uncovered an active mass credential-theft campaign by group UAT-10608 exploiting a critical React Server Components RCE (CVE-2025-55182, aka React2Shell) in Next.js servers; automated scanners deployed an infostealer that harvested DB credentials, SSH keys, cloud tokens, payment keys and GitHub tokens from 700+ hosts and reported them to a 'NEXUS Listener' dashboard, enabling large-scale account and cloud takeovers.