UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications
Summary: Cisco Talos disclosed a campaign by a threat cluster it tracks as UAT-10608 that exploited Next.js applications vulnerable to React2Shell (CVE-2025-55182) to compromise at least 766 hosts across multiple regions and cloud providers, using a framework called NEXUS Listener. The automated toolkit harvested database credentials from roughly 701 hosts (91.5%), SSH private keys from about 599 (78.2%), AWS credentials from about 196 (25.6%), and live Stripe API keys from about 87 (11.4%), collecting 10,120 files in total.
Bottom line: The framework compromised 766 hosts within a 24-hour period with no manual interaction, and the SSH private keys found on 78% of them enable lateral movement to any system trusting the compromised host's key identity. Talos obtained data from an unauthenticated NEXUS Listener instance, meaning the harvested credentials were themselves exposed.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2025-55182
- Related
- IR Trends Q4 2025: Exploitation remains dominant, phishing campaign targets Native American tribal organizations Cyber Risks ·CVE-2025-55182: Meta React Server Components Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 05, 2025