# Bissa Scanner exploits React2Shell at scale with AI workflow

Published: 2026-04-22 · Severity: critical · Sectors: financial-services, technology, retail
Canonical: https://vorant.io/reports/5c94f93d-4301-56fe-9660-359376e04f4c/bissa-scanner-exploits-react2shell-at-scale-with-ai-workflow

> Exposed server reveals AI-assisted mass exploitation operation using React2Shell (CVE-2025-55182) that compromised 900+ organizations and harvested tens of thousands of credentials.

The DFIR Report discovered an exposed server belonging to the Bissa Scanner operation, revealing a sophisticated AI-assisted mass exploitation campaign. The threat actor leveraged Claude Code and OpenClaw to orchestrate a large-scale exploitation workflow targeting CVE-2025-55182 (React2Shell), a vulnerability in Next.js applications. The operation scanned millions of internet-facing targets and confirmed over 900 successful compromises, with an automated pipeline for exploitation, credential harvesting, and victim triage.

The server contained over 13,000 files showing systematic credential theft targeting AI providers, cloud services, payment platforms, databases, and messaging systems. The operator collected over 30,000 environment files between April 10-21, 2026, with particular focus on high-value targets in financial services, cryptocurrency, and retail sectors. Post-compromise activity included deeper collection of financial records, payroll data, HR information, and CRM databases from validated victims. The operation used S3-compatible Filebase storage (bucket 'bissapromax') for data exfiltration and Telegram bots for real-time alerting.

The infrastructure traces to a single operator using Telegram handle @BonJoviGoesHard (display name 'Dr. Tube'), who operates dedicated alerting bots @bissapwned_bot and @bissa_scan_bot. The exposed server also showed targeting of WordPress sites via CVE-2025-9501 (W3 Total Cache plugin), though no successful exploitation evidence was found for this vector. The operation demonstrates a mature, modular approach to mass exploitation with AI-enhanced workflow automation for credential validation and victim prioritization.

## Mentioned in this report

- Vulnerabilities: CVE-2025-55182 (KEV), CVE-2025-9501
- Threat actors: Dr. Tube
- Malware: Bissa Scanner
- Campaigns: Bissa Scanner

## Detection guidance (public sample)

### Node.js Web Process Spawning Command Interpreter (Possible RCE Exploitation)

ATT&CK: T1190

Detects a Node.js/Next.js server process spawning a shell or download utility, consistent with exploitation of RCE vulnerabilities like CVE-2025-55182 (React2Shell) leading to command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Node.js Web Process Spawning Command Interpreter
id: db9dd9f1-690f-5926-a7a8-4a3e2db70da1
status: experimental
description: Detects a Node.js/Next.js server process spawning a shell or download
  utility, consistent with exploitation of RCE vulnerabilities like CVE-2025-55182
  (React2Shell) leading to command execution.
references:
- https://thedfirreport.com
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /node
    - /next-server
  child_process:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /curl
    - /wget
  filter_build:
    CommandLine|contains:
    - npm run
    - npm install
    - yarn install
    - next build
  condition: selection and child_process and not filter_build
falsepositives:
- Legitimate npm/yarn build or install scripts invoking shell helpers
- CI/CD pipelines that run Next.js build steps inside containers
level: medium
tags:
- attack.t1190
- attack.initial-access
author: Vorant
```

### Mass Search or Harvest of Environment and Credential Files

ATT&CK: T1552.001

Detects command-line activity searching or extracting .env files or embedded credentials/API keys across a filesystem, consistent with mass credential harvesting seen in the Bissa Scanner operation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Mass Search or Harvest of Environment and Credential Files
id: 36eb209f-da8a-5c83-adbf-d06254f280a7
status: experimental
description: Detects command-line activity searching or extracting .env files or embedded
  credentials/API keys across a filesystem, consistent with mass credential harvesting
  seen in the Bissa Scanner operation.
references:
- https://thedfirreport.com
logsource:
  category: process_creation
  product: linux
detection:
  selection_find:
    CommandLine|contains|all:
    - find
    - .env
  selection_grep:
    CommandLine|contains:
    - grep -r
    - grep -R
    CommandLine|contains|all:
    - grep
  selection_keywords:
    CommandLine|contains:
    - AWS_SECRET_ACCESS_KEY
    - DATABASE_URL
    - API_KEY
    - STRIPE_SECRET
    - .env.production
    - .env.local
  condition: (selection_find or selection_grep) and selection_keywords or selection_find
falsepositives:
- Developers or sysadmins auditing configuration files during legitimate maintenance
- Security scanning/compliance tools that enumerate environment files
level: medium
tags:
- attack.t1552.001
- attack.credential-access
author: Vorant
```

### Exfiltration to S3-Compatible Cloud Storage via CLI with Custom Endpoint

ATT&CK: T1567.002

Detects use of aws-cli or rclone with a non-AWS custom S3 endpoint URL (e.g., third-party providers like Filebase), a pattern used to exfiltrate stolen credentials and data to attacker-controlled cloud storage. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Exfiltration to S3-Compatible Cloud Storage via CLI with Custom Endpoint
id: 81a04d6b-4194-5b3b-a2d0-3f985a4d4467
status: experimental
description: Detects use of aws-cli or rclone with a non-AWS custom S3 endpoint URL,
  a pattern used to exfiltrate stolen credentials and data to attacker-controlled
  cloud storage such as Filebase.
references:
- https://thedfirreport.com
logsource:
  category: process_creation
  product: linux
detection:
  selection_tool:
    Image|endswith:
    - /aws
    - /rclone
  selection_s3:
    CommandLine|contains:
    - s3 cp
    - s3 sync
    - copyto
    - sync
  selection_custom_endpoint:
    CommandLine|contains:
    - --endpoint-url
    - endpoint=
  filter_aws_official:
    CommandLine|contains:
    - amazonaws.com
  condition: selection_tool and selection_s3 and selection_custom_endpoint and not
    filter_aws_official
falsepositives:
- Legitimate use of self-hosted or third-party S3-compatible object storage by IT/backup
  teams
- Developers testing MinIO or other on-prem S3-compatible storage
level: medium
tags:
- attack.t1567.002
- attack.exfiltration
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5c94f93d-4301-56fe-9660-359376e04f4c/bissa-scanner-exploits-react2shell-at-scale-with-ai-workflow.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup