React2Shell Exploitation Delivers Crypto Miners and New Malware Across Multiple Sectors

According to Huntress, the React2Shell campaign continues to exploit the maximum-severity CVE-2025-55182 in React Server Components to deliver cryptocurrency miners and a range of previously undocumented malware families across multiple sectors, including Linux and Windows hosts.

The attackers are linked to a December 4, 2025 Windows endpoint exploitation that dropped a shell script before deploying a miner and a Linux backdoor, with later activity involving discovery commands and attempts to fetch payloads from a C2 server. The campaign has been observed targeting numerous organisations and, in some cases, dropping the XMRig miner on Linux hosts and using a GitHub tool to identify vulnerable Next.js instances.

PeerBlight, CowTunnel, ZinFoq and other payloads are described by Huntress as part of this exposed toolkit, with PeerBlight described as a Linux backdoor and ZinFoq as a post-exploitation framework, each capable of actions such as file operations, reverse shells, and persistence. Shadowserver data noted over 165,000 IP addresses and 644,000 domains with vulnerable code as of 8 December 2025, while LOLlolLOL-prefixed DHT nodes numbered over 60.