PCPcat Malware Leverages React2Shell Vulnerability to Breach 59,000+ Servers

A recent attack campaign attributed to a group named "PCP" has compromised 59,128 servers within 48 hours by exploiting critical vulnerabilities in Next.js. Security researchers uncovered this large-scale operation during the monitoring of a Docker honeypot, revealing an industrialized attack infrastructure with command-and-control capabilities targeting React-based applications globally.

The campaign exploits CVE-2025-29927 and CVE-2025-66478, two critical Remote Code Execution vulnerabilities in the Next.js and React frameworks, achieving a 64.6% exploitation success rate. Direct reconnaissance of the command-and-control (C2) server indicated that PCPcat has scanned 91,505 IP addresses, with nearly 60,000 confirmed compromises.

Analysis of the C2 API endpoint /stats highlighted operational metrics indicating that attackers are processing 2,000 IPs per batch. Projections suggest approximately 41,000 additional server compromises daily if the campaign's current pace continues.

The attack features characteristics of large-scale intelligence operations combined with industrial-scale data exfiltration. Researchers estimate between 300,000 to 590,000 credential sets have already been stolen, with daily harvesting potentially reaching 307,500 additional credentials at current exploitation rates.

The PCPcat malware initiates attacks through extensive reconnaissance of public Next.js domains, employing sophisticated JSON payload manipulation with prototype pollution techniques. The exploit chain executes commands through child_process.execSync() functions, with results exfiltrated via HTTP header redirects.

Following successful exploitation, the malware prioritizes extraction of sensitive files, including environment variable databases (.env files), SSH private keys, AWS credentials, Docker configuration files, Git credentials, and system authentication files. The malware also queries ~/.bash_history to capture recent command sequences, enabling attackers to identify additional attack vectors within compromised environments.

The campaign establishes persistence through the installation of GOST v2.12.0, a SOCKS5 proxy on localhost:1080, and FRP (Fast Reverse Proxy) v0.52.3, which creates outbound tunnels to the C2 infrastructure. These tools enable network pivoting and long-term access persistence through systemd service creation with automatic restart capabilities that survive system reboots.

The C2 infrastructure operates from a Singapore-based server (67.217.57.240) across three primary ports. Port 666 functions as the distribution server for malicious payloads, port 888 hosts the FRP reverse tunnel infrastructure, and port 5656 serves as the API command center. Critically, the C2 API operates without authentication or authorization mechanisms, allowing unrestricted access to operational endpoints.

Analysis of the exposed C2 API revealed multiple security vulnerabilities. The /domains endpoint returns 2,000 target IP addresses per request without client validation. The /result endpoint accepts credential data without input sanitization, successfully ingesting fake AWS credentials, GitHub tokens, and SSH keys during testing. Most critically, the /stats endpoint publicly exposes complete campaign metrics, including total targets scanned, successful exploitations, credential collection counts, and operational batch information.

Organizations using Next.js or React applications should immediately implement patched versions addressing CVE-2025-29927 and CVE-2025-66478. Security teams should audit environment variables, SSH keys, and credential stores for unauthorized access indicators. Network monitoring should prioritize detection of outbound connections to 67.217.57.240 on ports 666, 888, and 5656, along with GOST and FRP process identification on compromised systems.

Based on reporting by GBHackers.