59,000 Servers Breached: Operation PCPcat Targets React and Next.js at Internet Scale

Operation PCPcat is a fast-moving, large-scale cyber espionage campaign that exploited Next.js/React vulnerabilities (CVE-2025-29927, CVE-2025-66478) via prototype pollution to achieve remote code execution across ~59,128 servers, exfiltrating an estimated 300,000–590,000 credential sets, coordinating attacks from a centralized C2 (67.217.57.240), and maintaining persistence via proxy tooling and automated scanning for continued propagation.