Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

Alarge-scale credential harvesting operationhas beenobserved exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services (AWS) secrets, shell command history, Stripe API keys, and GitHub tokens atscale. CiscoTalos has attributed the operation to a threat cluster it tracksas