Tradecraft Tuesday Recap: React2Shell, ClickFix, and the Rise of AI Scams

Huntress reports rapid, active exploitation of a critical React server RCE (CVE-2025-55182) that has scaled quickly and is delivering cryptominers, a PeerBlight Linux backdoor, tunneling tools and botnet variants; the briefing also highlights social-engineering techniques (ClickFix) that trick users into executing commands, phishing that leverages legitimate services, and scams such as sextortion, romance fraud and pig-butchering, concluding with practical mitigations (MFA/passkeys, password managers, call screening, social media restrictions, credit freezes and treating unexpected inbound messages as suspect).