An emerging threat cluster tracked as UAT-10608 is exploiting vulnerable Web-exposed Next.js apps and using an automated tool to exfiltrate credentials, secrets, and other system data.
Automated Credential Harvesting Campaign Exploits React2Shell Flaw
Summary + source link. No paywalls, no tracking.