Hackers Use LLM to Create React2Shell Malware, the Latest Example of AI-Generated Threat

Darktrace captured an AI-generated malware campaign that exploited the disclosed React2Shell vulnerability via an exposed Docker daemon; the payload (container named "python-metrics-collector") deployed a XMRig Monero miner after downloading an LLM-generated Python exploitation script hosted on GitHub. The report highlights that large language models enabled rapid generation of a working exploit framework that compromised more than ninety hosts, lowering the bar for low-skilled operators and stressing the need for rapid patching, continuous attack-surface monitoring, and behavioral detection.