A significant credential harvesting campaign has been identified, targeting vulnerabilities in Next.js applications. Cisco Talos attributes this operation to a threat group known as UAT-10608, which has compromised at least 766 hosts across various regions and cloud platforms.
This operation exploits a critical flaw, designated as CVE-2025-55182, in React Server Components, allowing attackers to gain initial access. Once inside, the group deploys a sophisticated multi-phase harvesting framework named NEXUS Listener through a dropper, enabling the extraction of sensitive information such as SSH private keys, AWS secrets, and API credentials.
Security experts Asheer Malhotra and Brandon White noted that this threat cluster utilizes automated scripts to extract and exfiltrate data, which is then sent to a command-and-control server featuring a web-based interface. This interface provides operators with analytical insights and access to the stolen credentials, indicating a highly organized and automated approach to the attacks.