Full Report
From "React2Shell" exploitation to sophisticated "Living off Trusted Sites" phishing, Huntress experts break down the threats targeting both enterprises and families today.
Analysis Summary
# Tool/Technique: React2Shell (CVE-2025-55182 Exploitation)
## Overview
React2Shell refers to the active exploitation of a critical remote code execution (RCE) vulnerability in React Server Components. Attackers leverage this vulnerability to gain initial access to internet-facing web applications, subsequently deploying various malicious payloads.
## Technical Details
- **Type:** Vulnerability / Exploit Technique
- **Platform:** Cross-platform (specifically impacting web servers running vulnerable React versions); payloads observed on Linux and Windows.
- **Capabilities:** Remote Code Execution (RCE), Initial Access, Payload Delivery.
- **First Seen:** December 2025 (Exploitation accelerated following the December 3, 2025, disclosure).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application
- **TA0002 - Execution**
- T1059 - Command and Scripting Interpreter
- **TA0011 - Command and Control**
- T1572 - Protocol Tunneling
## Functionality
### Core Capabilities
- **Unauthenticated RCE:** Allows attackers to execute arbitrary code on the server hosting the React application without valid credentials.
- **Rapid Payload Deployment:** Used as a delivery mechanism for secondary stage malware immediately following successful exploitation.
### Advanced Features
- **Multi-Payload Versatility:** Observed dropping diverse toolsets including:
- **PeerBlight:** A Linux-specific backdoor.
- **Kaiji Botnet:** A variant used for DDoS and resource hijacking.
- **Tunneling Tools:** Used to bypass firewalls and establish persistent C2 channels.
- **Cryptominers:** For immediate monetization of compromised resources.
---
# Tool/Technique: ClickFix
## Overview
ClickFix is a sophisticated social engineering technique, categorized as "Living off Trusted Sites" (LoTS) or "Human-as-a-Service" exploitation. It tricks users into manually executing malicious code by mimicking legitimate system verification or troubleshooting prompts.
## Technical Details
- **Type:** Social Engineering / Malware Delivery Technique
- **Platform:** Windows, macOS (targets browser users)
- **Capabilities:** Evasion of automated detection, Execution via user interaction, Clipboard hijacking.
- **First Seen:** Throughout 2024; remains highly active in late 2025.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566 - Phishing
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
- T1059 - Command and Scripting Interpreter
- **TA0005 - Defense Evasion**
- T1132 - Data Encoding (Commands hidden in encoded strings)
## Functionality
### Core Capabilities
- **Social Engineering Normalization:** Mimics CAPTCHAs or "Human Verification" screens to lower user suspicion.
- **Clipboard Injection:** The website automatically copies a malicious PowerShell or Terminal command to the victim's clipboard.
- **Guided Execution:** Provides step-by-step visual instructions (e.g., "Press Win+R, Ctrl+V, and Enter") to force the user to execute the malware.
### Advanced Features
- **Behavioral Bypass:** Because the user manually opens the terminal and pastes the command, many endpoint security products may flag the activity as "authorized" administrative action rather than an automated exploit.
## Indicators of Compromise
- **Network Indicators:** Links to malicious domains masquerading as verification services (e.g., `human-verify[.]com`).
- **Behavioral Indicators:**
- Unexpected `powershell.exe` or `cmd.exe` launches following browser activity.
- Commands containing `Base64` strings or `IEX` (Invoke-Expression) parameters being executed from the clipboard.
## Associated Threat Actors
- **ClearFake** (Known for earlier iterations of social engineering overlays)
- **Various eCrime groups** (Specifically those distributing Infostealers and Remote Access Trojans)
## Detection Methods
- **Behavioral Detection:** Monitoring for browser processes (Chrome, Edge) spawning system shells or suspicious PowerShell command-line arguments.
- **Clipboard Monitoring:** EDR solutions that can flag when a browser writes high-risk commands to the system clipboard.
## Mitigation Strategies
- **User Education:** Training users to never copy-paste and execute commands provided by websites.
- **Attack Surface Reduction:** Restrict PowerShell execution via Execution Policies or Constrained Language Mode (CLM).
- **Patch Management:** (For React2Shell) Immediate patching of React frameworks to versions mitigating CVE-2025-55182.
## Related Tools/Techniques
- **Log4Shell:** Cited as a comparison for the scale and speed of React2Shell exploitation.
- **ClearFake:** A similar cluster of activity involving fake browser updates.