Threats tagged 'next.js'

A coordinated campaign is targeting developers through malicious repositories disguised as legitimate Next.js projects and technical assessment materials. The attack uses multiple entry points that lead to runtime retrieval and local execution of attacker-controlled JavaScript, transitioning into staged command-and-control. The campaign employs three main execution paths: Visual Studio Code workspace automation, build-time execution during application development, and server startup execution via environment variable exfiltration and dynamic remote code execution. The attack chain includes a Stage 1 C2 beacon for registration and a Stage 2 C2 controller for persistent tasking. This sophisticated approach allows attackers to blend into routine developer workflows, increasing the likelihood of code execution and potentially compromising high-value assets such as source code, environment secrets, and access to build or cloud resources.

Campaign#next.js#command-and-controlUnited States+9

A persistent nine-month RondoDoX botnet campaign has been targeting IoT devices and web applications. The threat actors have recently shifted to weaponizing a critical Next.js vulnerability, deploying malicious payloads like 'React2Shell' and cryptominers. The campaign, spanning from March to December 2025, shows quick adaptation to latest attack trends. The activity is divided into three phases: initial reconnaissance, web application exploitation, and IoT botnet deployment. The attackers have been using multiple command and control servers and deploying various malware variants. The campaign has intensified in December 2025 with a focus on Next.js exploitation. The impact includes widespread IoT device compromise, Next.js application risks, credential harvesting, and persistent multi-architecture threats.

Campaign#rondodox#command and controlGermany+7

CVE-2025-55182, known as React2Shell, is a critical Remote Code Execution vulnerability affecting React Server Components (RSC) and related frameworks such as Next.js, Waku, and Vite. It arises from improper input deserialization in RSC payloads, enabling attackers to execute arbitrary code. Exploitation has been observed in cloud environments targeting containerized workloads, facilitating initial access, credential theft, cryptomining, and deployment of advanced backdoors. Public exploit code is available, and the vulnerability is actively exploited in the wild, including use in ransomware campaigns. No specific affected versions or patch information is provided. Detection templates exist to aid identification of exploitation attempts.