The Rise of Vibecoding: AI-Generated Malware Exploits React2Shell

Darktrace observed an AI-generated malware campaign exploiting the React2Shell vulnerability (CVE-2025-55182) by spawning a deceptively named container on an exposed Docker daemon to install tools and run a Python payload that deployed XMRig to mine Monero; the attacker’s use of a public mining pool revealed earnings and demonstrated how AI can enable fast, low-skill exploitation.