React2Shell Exploitation Delivers Crypto Miners and New Malware Across Multiple Sectors

Dec 10, 2025

React2Shell continues to witness heavy exploitation, with threat actors leveraging the maximum-severity security flaw in React Server Components (RSC) to deliver cryptocurrency miners and an array of previously undocumented malware families, according to new findings from Huntress.
This includes a Linux backdoor called PeerBlight, a reverse proxy tunnel named CowTunnel, and a Go-based

Get Free Report & Network Analysis

Please check your email for the free report.