Operation PCPcat Hacked 59,000+ Next.js/React Servers Within 48 Hours
A large-scale credential-theft campaign, identified as PCPcat , has compromised 59,128 Next.js servers within a span of 48 hours. This operation exploits critical vulnerabilities CVE-2025-29927 and CVE-2025-66478, achieving a 64.6% success rate across…
A large-scale credential-theft campaign, identified as PCPcat , has compromised 59,128 Next.js servers within a span of 48 hours. This operation exploits critical vulnerabilities CVE-2025-29927 and CVE-2025-66478, achieving a 64.6% success rate across 91,505 scanned targets.
The PCPcat operation employs scanners distributed via react.py malware, which probe public Next.js deployments for remote code execution (RCE) vulnerabilities. Attackers exploit prototype pollution in JSON payloads to inject commands using child_process.execSync(), initially confirming RCE with an 'id' test. Subsequently, credentials are extracted from .env files, SSH keys, AWS configurations, Docker tokens, Git credentials, and bash history.
Following the initial compromise, the affected hosts download proxy.sh from 67.217.57.240:666, installing GOST SOCKS5 proxy, FRP reverse tunnels, and persistent systemd services such as pcpcat-gost.service.
The command-and-control (C2) server at 67.217.57.240:5656 operates an unauthenticated API, publicly exposing statistics via GET /stats: 91,505 IPs scanned, 59,128 successful compromises, with a batch size of 2,000 random IPs.
Nodes retrieve targets via GET /domains?client=<ID> and exfiltrate data through POST /result (up to 2MB JSON payloads), while health checks are conducted at /health. Reconnaissance efforts have confirmed data ingestion, with FRP tunneling on port 888 enabling lateral movement.
Endpoint Purpose Status
A large-scale credential-theft campaign, identified as PCPcat , has compromised 59,128 Next.js servers within a span of 48 hours.
/domains?client=<ID> Target assignment Active
/result Credential exfiltration Accepts data
/stats Campaign metrics Exposes 59K compromises
/health Server check Responsive
Key IoCs include C2 IPs (67.217.57.240 ports 666/888/5656), specific files (/opt/pcpcat/*, ~/.pcpcat_installed), processes (gost -L socks5://:1080, frpc), and logs containing "UwU PCP Cat was here~", t.me/Persy_PCP. Honeypots have captured Docker API abuse on port 2375 for containerized persistence.
Detection rules have been established, including Suricata alerts for /result POSTs with "env" payloads and YARA rules for react.py strings such as "CVE-2025-29927" and "PCPcat".
The campaign has been attributed to "PCP Cat" via Telegram channels t.me/teampcp, mapping to MITRE ATT&CK techniques like T1190 (public app exploit) and T1552 (unsecured credentials).
Projections indicate the potential for 41,000 daily compromises, resulting in the harvesting of over 300,000 credentials for possible cloud account takeovers or resale. Users of Next.js are strongly advised to apply patches promptly, block C2 domains, rotate credentials, and monitor for unusual systemd activity.
Based on reporting by Cyber Security News.