Bissa Scanner — AI-Assisted Mass Exploitation and Credential Harvesting Campaign (@BonJoviGoesHard / Dr. Tube)
Bissa Scanner (TL-2026-0411), also tracked as Bissa Scanner, is a high-severity tracked intrusion set scored CVSS 9, first published 2026-04-22. It is attributed to BonJoviGoesHard with high confidence, affects Vercel Next.js, references 2 CVEs (CVE-2025-55182, CVE-2025-9501), maps to 25 MITRE ATT&CK techniques (T1005, T1048.003, T1059.004), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0411
- Threat ID
- TL-2026-0411
- Also known as
- Bissa Scanner, bissapwned Campaign, Dr. Tube Operation
- Severity
- HIGH
- CVSS
- 9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- 2026-04-22
- Last reviewed
- 2026-04-22
- Attribution
- BonJoviGoesHard
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- financial-services, cryptocurrency, retail, payroll-hr, ai-platforms, cloud-services, e-commerce, fintech
- Target regions
- North America, Europe, United Kingdom, Australia
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Bissa Scanner
Malware and tooling: Bissa Scanner, Claude Code, OpenClaw, Telegram Bot API
The DFIR Report disclosed Bissa Scanner — an exposed operator-run, AI-assisted mass-exploitation platform attributed to a single Telegram-handled actor (@BonJoviGoesHard / Dr. Tube) that weaponized CVE-2025-55182 (React2Shell, Next.js middleware RCE) and CVE-2025-9501 (W3 Total Cache unauthenticated command injection) to compromise 900+ internet-facing applications and exfiltrate 30,000+ .env files, cloud keys, and API tokens. The operator industrialized scanning, triage, and secret validation using Claude Code and OpenClaw as an in-loop engineering harness, with Telegram bots (@bissapwned_bot, @bissa_scan_bot) for real-time alerting and a Filebase S3 bucket (bissapromax) for staging 400+ ZIP batches containing 65,000+ archived file entries. Harvested secrets span financial services, crypto custodians, retail, payroll/HR, AI platforms, cloud providers, and auth vendors, creating systemic downstream supply-chain and account-takeover risk.
How Bissa Scanner works
On 2026-04-22, The DFIR Report published a deep-dive disclosure of a mass-exploitation and secret-harvesting pipeline branded by its own operator as Bissa Scanner. The research team recovered the operator's internal tooling, scanner codebase, Telegram bot telemetry, and staging infrastructure after the operator inadvertently exposed a leased control-plane endpoint. The campaign is attributed — with HIGH confidence — to a single individual operating under the Telegram handles @BonJoviGoesHard and Dr. Tube, working from a Linux workstation that doubled as the scanner's orchestrator.
The operator's primary weaponization target was CVE-2025-55182 (React2Shell), a remote code execution flaw in Next.js middleware request handling that allows an unauthenticated attacker to smuggle an x-middleware-subrequest header chain, bypass authentication and middleware gating, and reach internal server-rendered routes that evaluate attacker-controlled input as JavaScript. A secondary exploit module weaponized CVE-2025-9501, an unauthenticated command-injection vulnerability in the W3 Total Cache WordPress plugin's CDN purge endpoint. The scanner fingerprinted both stacks via HTTP banner heuristics and favicon hashing, then launched exploit leases against candidate targets in staggered batches to avoid upstream rate-limiting.
Successful compromise on a Next.js target resulted in the deployment of a staged dropper that walked the application root for .env, .env.local, .env.production, next.config.js, and package.json, recursively pulled node_modules/.bin metadata, and compressed findings into a numbered ZIP (bissa-batch-NNNN.zip) uploaded to the operator's Filebase S3 bucket bissapromax. On WordPress/W3 Total Cache targets the same pipeline harvested wp-config.php, wp-content/uploads, mu-plugins, and any detected AWS/Stripe/SendGrid keys in wp_options.
The novel TTP disclosed by the report is the operator's tight coupling of Claude Code and OpenClaw as an AI-assisted engineering harness for the scanner itself — not for victim compromise, but for operator productivity. The DFIR Report recovered conversation transcripts showing the operator using Claude Code to refactor the lease/acknowledgement queueing logic, debug a race condition in the exploit-worker pool, write benchmark harnesses to rank target-generation strategies, and translate error messages from the scanner's Go-based HTTP worker into Python for triage. OpenClaw was used as a sandboxed container harness to iterate on scanner modules without polluting the operator's host. This pattern — using agentic coding assistants to compress the operator development cycle for offensive tooling — represents an inflection point in the industrialization of opportunistic mass exploitation.
Telemetry recovered from the two Telegram bots (@bissapwned_bot for hit alerts, @bissa_scan_bot for scan-queue control) confirms 900+ successful compromises across 400+ exfil batches, 30,000+ unique .env files, and 65,000+ total archived file entries. Victim geography skews toward North America and Europe, with heavy representation in financial services, cryptocurrency custodians and exchanges, retail e-commerce, and payroll/HR SaaS. Recovered harvested credentials include AWS access keys, Stripe live keys, SendGrid API tokens, Anthropic and OpenAI API keys, GitHub personal access tokens, Auth0 and Okta client secrets, and private keys for MetaMask/Coinbase/custodial wallets. At least 40 of the AWS keys were observed being reused by the operator within 24 hours for secondary enumeration against S3 and IAM, indicating hands-on-keyboard follow-through rather than pure bulk hoarding.
The DFIR Report's exposure has burned the operator's current infrastructure (Filebase bucket, Telegram bots, and the leased VPS fronting the scanner control plane), but the operator's tooling has been open enough — and replicable enough — that copycat deployment by other opportunistic actors should be expected within weeks. Defenders are urged to treat every Next.js and W3 Total Cache deployment touched during the campaign window as credential-compromised, rotate all long-lived secrets in affected environments, and deploy detections for the specific middleware-subrequest header patterns and CDN-purge exploitation traces documented below.
MITRE ATT&CK techniques used in TL-2026-0411
Collection
T1005 Data from Local System; T1560.001 Archive via Utility
Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1567.002 Exfiltration to Cloud Storage
Execution
T1059.004 Unix Shell; T1059.006 Python
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication
Initial Access
T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application
Discovery
T1083 File and Directory Discovery; T1580 Cloud Infrastructure Discovery
Defense Evasion
T1211 Exploitation for Stealth
Credential Access
T1552.001 Credentials In Files; T1552.004 Private Keys; T1552.005 Cloud Instance Metadata API
Resource Development
T1583.006 Web Services; T1587.001 Malware; T1588.005 Exploits; T1608.001 Upload Malware
Reconnaissance
T1592 Gather Victim Host Information; T1595 Active Scanning; T1595.002 Vulnerability Scanning
Impact
defense-impairment
Affected products and versions in Bissa Scanner
- Vercel — Next.js
Vulnerable versions: <14.2.32; 15.0.0-15.4.6
Fixed in: 14.2.32; 15.4.7 - BoldGrid — W3 Total Cache (WordPress Plugin)
Vulnerable versions: <2.8.13
Fixed in: 2.8.13
Remediation for Bissa Scanner
Patches
- Next.js 14.2.32 (CVE-2025-55182 fix)
- Next.js 15.4.7 (CVE-2025-55182 fix)
- W3 Total Cache 2.8.13 (CVE-2025-9501 fix)
Immediate actions
- Rotate every long-lived secret (AWS/GCP/Azure keys, Stripe live keys, SendGrid, Twilio, Anthropic/OpenAI API keys, GitHub PATs, Auth0/Okta client secrets, SSH keys) on any internet-facing Next.js or WordPress host patched after 2025-09-01
- Block egress to Filebase S3 endpoints (s3.filebase.com, *.s3.filebase.com) at perimeter and inspect historical netflow for bissapromax bucket access
- Hunt web server access logs for x-middleware-subrequest header values containing 'src/middleware' or repeated middleware path chaining (React2Shell fingerprint)
- Hunt WordPress request logs for unauthenticated POSTs to /wp-admin/admin-ajax.php?action=w3tc_cdn_purge_all with suspicious shell metacharacters
- Revoke any Telegram bot tokens used for operational monitoring and audit for outbound traffic to api.telegram.org from server workloads
Workarounds
- Strip or block x-middleware-subrequest header at reverse proxy / CDN until Next.js can be upgraded
- Disable W3 Total Cache CDN purge functionality or require authenticated admin context via mu-plugin override
- Enforce egress allow-listing on production workloads so .env exfiltration to untrusted S3 endpoints is dropped
Longer-term hardening
- Upgrade Next.js to 14.2.32 / 15.4.7 or later and remove legacy middleware-subrequest compatibility code paths
- Upgrade W3 Total Cache to 2.8.13 or later; disable plugin on sites that do not require CDN purging
- Adopt short-lived, scoped credentials (AWS STS, GitHub fine-grained PATs, Stripe restricted keys) so that any .env leak has bounded blast radius
- Deploy secret scanning (TruffleHog, GitLeaks, or CI-integrated equivalent) against deployed artifact trees and block .env from ever shipping to production image layers
- Implement application-layer rate limiting and WAF rules for repeated subrequest header chains and unauthenticated admin-ajax plugin actions
CVEs associated with Bissa Scanner
Weaknesses (CWE) in Bissa Scanner
CWE-290, CWE-78, CWE-94, CWE-288, CWE-200
Timeline of Bissa Scanner
- Vercel publishes security advisory for CVE-2025-55182 (React2Shell) — Next.js middleware subrequest header authorization bypass leading to RCE. Patches released in 14.2.32 and 15.4.7.
- Public proof-of-concept exploit for CVE-2025-55182 published to GitHub demonstrating x-middleware-subrequest header chaining to reach unauthenticated internal routes.
- W3 Total Cache 2.8.13 released, patching CVE-2025-9501 — unauthenticated command injection in CDN purge handler. Plugin maintainers disclose exploitation reports in the wild.
- CISA adds CVE-2025-55182 to the Known Exploited Vulnerabilities catalog citing confirmed in-the-wild exploitation.
- Earliest observed Bissa Scanner scanning traffic in honeypot telemetry; scanner User-Agent 'bissa-hunter/0.3' fingerprinted Next.js banners and favicon hashes.
- Operator registered Telegram bots @bissapwned_bot (hit alerts) and @bissa_scan_bot (scan-queue control), observed in captured scanner source metadata.
- Filebase S3 bucket 'bissapromax' created and first exfil batch bissa-batch-0001.zip observed — 127 .env files.
- Operator conversation transcripts recovered from an exposed OpenClaw container show the actor adopting Claude Code as an engineering harness to refactor exploit-worker lease logic and benchmark target-generation strategies.
- Peak campaign activity — batch 0300 uploaded; cumulative 20,000+ .env files across 450+ compromised hosts.
- Operator inadvertently exposed the leased VPS control plane; DFIR Report investigators fingerprinted the scanner and began evidence collection.
- The DFIR Report publishes the full Bissa Scanner disclosure, burning the campaign's active infrastructure and triggering industry-wide credential rotation advisories.
- As of 2026-05-29, the Bissa operator's exposed infra (Filebase bucket, Telegram bots, VPS) was burned by The DFIR Report's 22-Apr disclosure and LE engaged, but no arrest is confirmed and copycats are expected. Its core weapon, CVE-2025-55182 (React2Shell, CVSS 10.0, CISA KEV 5-Dec-2025), remains under broad active exploitation.
Sources cited for Bissa Scanner
- Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting
- Automated Credential Harvesting Campaign Exploits React2Shell
- CVE-2025-55182 — Next.js React2Shell RCE
- CVE-2025-9501 — W3 Total Cache Unauthenticated Command Injection
- MITRE ATT&CK — T1583.006 Acquire Infrastructure: Web Services
- Next.js Middleware Authorization Bypass Advisory
- W3 Total Cache CDN Purge Command Injection Advisory
- CISA KEV — CVE-2025-55182 Next.js Middleware RCE
Threats related to Bissa Scanner
- Bissa Scanner — AI-Assisted Mass Exploitation of CVE-2025-55182 (React Server Components RCE) and CVE-2025-9501 (W3 Total Cache)
- PCPJack Worm — Cloud Credential Theft Framework Evicting TeamPCP Infections (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703)
- CVE-2025-54068 Exploited in Large-Scale Laravel Livewire Credential Theft Campaign
Detection coverage for TL-2026-0411
As of 2026-04-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0411 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.