AI-generated malware exploits React2Shell vulnerability in cryptojacking campaign
Researchers at Darktrace identified malware generated by a large language model that exploited the React2Shell vulnerability (CVE-2025-55182) in Next.js server components to deploy cryptocurrency miners. The campaign infected 91 hosts across internet-facing Docker environments and generated minimal profits in Monero.
What happened
Researchers from Darktrace observed malware targeting an unauthenticated Docker daemon in the company's CloudyPots honeypot environment. The attacker spawned a container called python-metrics-collector and used it to download and execute a Python script that exploited the React2Shell vulnerability (CVE-2025-55182) in Next.js server components.
The script executed a Remote Code Execution attack by sending a crafted Next.js server component payload to the target, then deployed an XMRig cryptocurrency miner. Testing with the GPTZero AI-detection tool indicated a 76% probability the code was generated using a large language model, and it contained extensive educational commentary and documentation atypical of human-written malware.
Reported impact
The campaign infected 91 hosts across the honeypot environment. The attacker generated 0.015 Monero since inception, worth approximately 5 British pounds sterling, with daily earnings of roughly 1.33 pounds.
Index analysis
The malware demonstrated technical sophistication in its exploitation chain, including an IP generation loop to identify potential targets and confirmation of host vulnerability before deploying the cryptocurrency miner. However, the script lacked a built-in Docker spreader, requiring the attacker to manage propagation remotely, potentially from a residential IP address in India.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.