Executive Summary
Cisco Talos has identified a large-scale automated campaign by a threat cluster tracked as UAT-10608 targeting Next.js applications. The campaign exploits CVE-2025-55182 (React2Shell), a pre-authentication remote code execution vulnerability in React Server Components, to gain initial access to web servers and cloud environments.
Once a host is compromised, the actor deploys a multi-phase shell script that systematically extracts environment variables, SSH private keys, AWS/Azure/GCP cloud metadata, and Kubernetes tokens. This data is exfiltrated to a central Command and Control (C2) server running a specialized GUI titled 'NEXUS Listener,' which provides the attackers with searchable analytics and statistics on over 766 compromised hosts.
The impact is severe, as the harvested data includes live Stripe API keys, database connection strings with cleartext passwords, and production SSH keys. This enables follow-on activities such as lateral movement, financial fraud, and potential supply chain attacks via compromised package registry tokens. Organizations using Next.js should prioritize patching and credential rotation immediately.