ThreatsDay Bulletin: WhatsApp Hijacks, MCP Leaks, AI Recon, React2Shell Exploit and 15 More Stories

The ThreatsDay Bulletin flags a wave of familiar attack patterns evolving rather than disappearing, including a new GhostPairing method that hijacks WhatsApp by luring victims via a compromised account and a Facebook-style preview, prompting QR code or phone-number prompts to pair a attacker-controlled session.

It also highlights the exposure of roughly 1,000 Model Context Protocol (MCP) servers on the internet, with risks ranging from potential Kubernetes access to remote code execution when misconfigured, and notes that Intruder found more than 42,000 tokens exposed across around 5 million single-page applications.

In the React2Shell space, the CVE-2025-55182 vulnerability has been used as an initial access vector in a Weaxor ransomware attack, with more than 60 organisations reported impacted, and Microsoft reporting several hundred machines compromised across a diverse set of organisations. Taken together, the bulletin underscores a trend of attackers repurposing existing tools and techniques at scale, deploying automated campaigns, and chasing rapid exploitation across multiple platforms.