Scworld

Operation PCPcat Compromises Over 59,000 Next.js/React Servers

First seen 24 Dec 2025, 07:02 UTC • Gbhackers

•42.3

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Operation PCPcat has compromised 59,128 Next.js and React servers in under 48 hours, exploiting critical vulnerabilities CVE-2025-29927 and CVE-2025-66478. The attackers utilized prototype pollution in JSON payloads to achieve a 64.6% success rate across 91,505 scanned targets, deploying PCPCat scanners via react.py malware.

How this analysis works

Attack Flow

9 entities, 14 inferred relationships (STIX 2.1).

Technique (2)

Data Breach
Malware

Campaign (1)

Operation PCPcat

Vulnerability (2)

CVE-2025-29927
CVE-2025-66478

Malware (2)

PCPcat
React.py

Affected Platform (2)

Next.js
React

Relationships

PCPcat exploits CVE-2025-29927
PCPcat exploits CVE-2025-66478
React.py exploits CVE-2025-29927
React.py exploits CVE-2025-66478
Operation PCPcat uses PCPcat
Operation PCPcat uses React.py
CVE-2025-29927 targets Next.js
CVE-2025-29927 targets React
CVE-2025-66478 targets Next.js
CVE-2025-66478 targets React
Data Breach targets Next.js
Data Breach targets React
Malware targets Next.js
Malware targets React

Continue Reading

Vect and TeamPCP Form Alliance for Ransomware Operations PCPcat Malware Compromises Over 59,000 Servers via React2Shell Exploit TeamPCP Exploits Cloud Misconfigurations for Large-Scale Attacks

Operation PCPcat Compromises Over 59,000 Next.js/React Servers

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading