Operation PCPcat Exploits Next.js and React, Impacting 59,000+ Servers
A credential-stealing campaign, "Operation PCPcat," has compromised over 59,000 Next.js servers globally. The campaign exploits critical vulnerabilities in the React framework, targeting sensitive authentication data.
A credential-stealing campaign, "Operation PCPcat," has compromised over 59,000 Next.js servers globally. The campaign exploits critical vulnerabilities in the React framework, targeting sensitive authentication data.
Researchers identified the operation through honeypot monitoring, accessing the attackers' command-and-control infrastructure. The campaign has a 64.6% exploitation success rate, leading to 59,128 confirmed server compromises and approximately 300,000 to 590,000 credentials stolen.
The attackers exploit two critical vulnerabilities, CVE-2025-29927 and CVE-2025-66478, for remote code execution in Next.js deployments. The attack chain involves mass scanning of Next.js domains, followed by prototype pollution attacks using JSON payload manipulation.
Malware executes data extraction routines targeting .env files, SSH keys, cloud credentials, and environment variables. The command-and-control infrastructure, located in Singapore, operates through four primary API endpoints for task assignments, data collection, and operational metrics.
A credential-stealing campaign, "Operation PCPcat," has compromised over 59,000 Next.js servers globally.
The malware installs GOST proxy software and Fast Reverse Proxy components for persistence, enabling continuous scanning. Each compromised machine queries the C2 server for new targets every 45 minutes, potentially affecting 41,000 additional servers daily.
Organizations using Next.js should audit their deployments for unauthorized access, review .env file contents, rotate exposed credentials, and implement network segmentation. Detection can be enhanced using Suricata rules for prototype pollution attempts, YARA signatures for "pcpcat" malware, and behavioral analysis of child_process execution patterns.
67.217.57.240:666 - Distribution server (payload hosting) 67.217.57.240:888 - FRP C2 (reverse tunneling) 67.217.57.240:5656 - Main C2 API (task assignment, data exfiltration)
http://67.217.57.240:5656/domains - Target assignment (fetches 2000 IPs) http://67.217.57.240:5656/result - Data exfiltration (accepts credential POST) http://67.217.57.240:5656/health - Health check http://67.217.57.240:5656/stats - Operational metrics (EXPOSES CAMPAIGN DATA)
http://67.217.57.240:666/files/proxy.sh - Persistence installer http://67.217.57.240:666/files/react.py - Scanner/exploit module
Based on reporting by GBHackers.