UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications

The article "UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications" by Cisco Talos discusses a significant security incident involving the exploitation of vulnerabilities in Next.js, a popular JavaScript framework for building server-side rendered (SSR) web applications. The attackers leveraged these vulnerabilities to inject malicious code into SSR data and harvest sensitive credentials from compromised systems.

Key Points:

1. Vulnerability Details:

   • CVE-2025-55182: This vulnerability, also known as React2Shell, allows attackers to inject server-side secrets into the __NEXT_DATA__ object used by Next.js applications.
   • The attack vector involves manipulating SSR data injection points in Next.js.

2. Attack Methodology:

   • Attackers injected malicious code that triggered a script execution on the server side, leading to credential harvesting.
   • Malicious scripts were spawned from /tmp/, often with randomized dot-prefixed names (e.g., /.e40e7da0c.sh).
   • The use of nohup commands was observed in process listings, indicating persistent execution of malicious scripts.

3. **Imp

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.