Hackers are using Telegram bots and AI tooling to run a structured, at-scale exploitation campaign abusing the critical React2Shell vulnerability (CVE-2025-55182), with evidence of 900+ confirmed compromises.
Investigators found an exposed server tied to the Bissa scanner platform, used for multi-victim exploitation, staging, and validation rather than simple data dumping.
Logs and project artifacts show Bissa scanner using a dedicated module for CVE-2025-55182 to scan millions of internet-facing targets and automatically confirm successful exploitation.
At the center of this setup was React2Shell (CVE-2025-55182), a 10.0 CVSS pre-auth RCE in React Server Components and Next.js that allows code execution via a single HTTP request.
One “confirmed hits” file listed more than 900 compromised companies, indicating a high success rate against unpatched environments.
The exposed host contained over 13,000 files across more than 150 directories linked to exploitation, victim data staging, credential harvesting, and operator workflow management, reflecting an organized operation.
Claude Code and OpenClaw were tightly integrated into the attacker’s workflow, supporting code review, troubleshooting, orchestration, and refinement of the collection pipeline.
Claude transcripts under a /bissascanner/ project show the operator asking the model to understand scanner logic, debug lease flows, improve performance, and document components well enough to rebuild acquisition modules.
OpenClaw logs revealed a local AI-control surface on the same server, with a WebSocket gateway, browser control, a model pool (including claude-sonnet-4-6), and a Telegram-linked provider handle @bissa_scan_bot.
React2Shell exploitation was heavily tuned for secret harvesting, focusing on .env files, cloud metadata, Kubernetes service accounts, local credential stores, databases, and wallet material.
Across the Filebase S3-compatible storage buckets used as off-box archives, analysts counted 400+ env-batch ZIP archives, over 30,000 distinct .env filenames, and more than 65,000 archived file entries collected between 10–21 April 2026.
Stolen secrets spanned nearly every major SaaS tier, including AI providers (Anthropic, Google, OpenAI, Mistral, OpenRouter, Groq, Replicate, DeepSeek, HuggingFace), cloud platforms (AWS, Azure, Cloudflare, Google Cloud, DigitalOcean, Alchemy), payment and banking services (Stripe, PayPal, Shopify, Square, Plaid), messaging and email APIs (Twilio, SendGrid, Telegram, Resend, Vonage, Postmark), and databases like Supabase and MongoDB.
Source control, auth, and collaboration platforms such as GitHub, Auth0/Okta, Clerk, Slack, and others were also represented in the credential haul, giving the operator options for deeper lateral movement.
Beyond secrets, the server hosted victim-specific data clusters with sensitive business records.
Examples included tax and financial records (Victim A), Oracle Fusion exports tied to supplier and payment-process data (Victim B), and payroll, HRIS, and stablecoin payment information (Victim C), highlighting both financial and privacy risk.
The same box exposed the operator’s Telegram-based command-and-alerting layer, providing rare insight into the human behind the operation.
Runner scripts across the Bissa scanner harness embedded a Telegram bot token for @bissapwned_bot (display name “BissaPwned”, bot user ID 8798206332) with notifications sent into chat ID 1609309278.
Telegram metadata linked that destination to a private chat between the bot and a single operator, using the public username @BonJoviGoesHard and the display name “Dr. Tube.”
Each bot message encoded one confirmed CVE-2025-55182 hit as an emoji-delimited line, summarizing victim identity, runtime context, privilege level, cloud posture, and accessible secrets so the operator could triage hundreds of events directly from Telegram.
Bissa scanner relied on acquirer files sourced from ZIP archives hosted on cs2.ip.thc.org and from acquirer endpoints such as denemekulubum[.]com[.]tr/acquirer/, with an older feed previously hosted at wiprz[.]com/acquirer/.
The scanner watched a local results directory, batched .env files into ZIPs, and uploaded them to Filebase at s3.filebase[.]com in bucket “bissapromax” under /archives, with earlier stages labeled “bissa” and “bissa2.”
The platform also contained a WordPress module for CVE-2025-9501 in W3 Total Cache (pre-2.8.13), though only version checks were present, and no successful exploitation via this path was confirmed.
Taken together, the evidence points to a mature, modular operation: scan and exploit at internet scale, harvest and centralize secrets, then use AI and Telegram bots to validate, score, and prioritize the most valuable victims in sectors like finance, cryptocurrency, and retail.
Defenders are urged to patch React2Shell-affected stacks rapidly, move production credentials into managed secret stores, shrink blast radius with tight identity and RBAC controls, monitor egress to storage and messaging APIs, and aggressively rotate and detect leaked keys before attackers can weaponize them.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…