Back Thedfirreport

Bissa Scanner Exposed: AI

Thedfirreport •editor • April 22, 2026

Key Takeaways We identified an exposed server that provided unusual visibility into a large-scale, multi-victim exploitation and collection operation. Artifacts on the host showed that Claude Code and OpenClaw were embedded in the operator’s day-to-day workflow, supporting troubleshooting, orchestration, and refinement of the collection pipeline. This AI-assisted workflow resulted in the modular platform Bissa scanner […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Enhanced Credential Harvesting Operation Exposed A threat actor has integrated Anthropic's Claude Code AI into a large-scale credential harvesting operation named Bissa scanner. This operation has successfully exploited over 900 targets since September 2025, utilizing the React2Shell vulnerability (CVE-2025-6789) for remote code execution. The exposed server contained over 13,000 files and 30,000 unique .env filenames, indicating a systematic approach to data collection. The harvested credentials span various sectors, including AI providers and cloud services. The operation also employed OpenClaw for workflow management and troubleshooting. Despite patches being available since December 2025, the exploitation continues, raising significant security concerns. Researchers noted that the AI tools were used for development support rather than direct exploitation. 3 sources 70

Extracted Entities

Tools (1)

Bissa Scanner