Operation PCPcat: 60,000 Next.js Servers Hijacked in Just 48 Hours

Operation PCPcat has been described as a highly automated cyber-espionage campaign harvesting cloud credentials from compromised Next.js and React servers. According to Beelzebub Research Team, the attackers exploited CVE-2025-29927 and CVE-2025-66478 to compromise 59,128 servers in under two days, a rate they characterised as terrifyingly precise.

The campaign weaponises a JSON payload chain with prototype pollution to achieve Remote Code Execution, installs a persistent backdoor via GOST and FRP, and turns infected hosts into zombie nodes within a botnet. Researchers note the C2 API, hosted in Singapore, lacked basic authentication, allowing examination of the operation and its targets, including a “random_ips” mode scanning over 91,000 targets.

The operation is reported to be processing roughly 32 batches of targets per day, with potential to exceed 1.2 million compromised servers within a month if unchecked; organisations are urged to patch promptly, block the identified C2 IP 67.217.57[.]240, and rotate any credentials exposed in environment files.