Executive Summary
A large-scale exploitation campaign led by an operator known as "Dr. Tube" has been identified using a modular platform called Bissa Scanner. The operation leverages AI-assisted workflows, specifically Claude Code and OpenClaw, to orchestrate mass scanning and triage of victims. The campaign primarily exploits CVE-2025-55182 (React2Shell) and scans for CVE-2025-9501, resulting in over 900 confirmed compromises across millions of targets.
The technical backbone of the operation involves an automated pipeline for exploitation, hit scoring via Telegram bots, and the exfiltration of sensitive environment (.env) files to S3-compatible storage. The actor demonstrates a high degree of technical maturity by using AI to troubleshoot code and refine exploitation modules, focusing heavily on harvesting credentials for AI platforms, cloud providers, and payment gateways.
This campaign poses a significant risk to organizations in the financial, cryptocurrency, and retail sectors. Beyond simple credential theft, the actor has been observed performing deep post-compromise collection of sensitive business data, including HR, payroll, and CRM records, indicating a clear intent to operationalize high-value access for financial gain or follow-on attacks.