UAT-10608 Campaign Abuses React2Shell for Cloud Credential Harvesting (Campaign)

An automated campaign attributed to threat cluster UAT-10608 is exploiting vulnerable Next.js applications to achieve pre-authentication remote code execution and deploy a multi-phase credential harvesting framework. The operation has compromised hundreds of hosts across cloud...