# Bissa Scanner — AI-Assisted Mass Exploitation and Credential Harvesting Campaign (@BonJoviGoesHard / Dr. Tube)

> The DFIR Report disclosed Bissa Scanner — an exposed operator-run, AI-assisted mass-exploitation platform attributed to a single Telegram-handled actor (@BonJoviGoesHard / Dr. Tube) that weaponized CVE-2025-55182 (React2Shell, Next.js middleware RCE) and CVE-2025-9501 (W3 Total Cache unauthenticated command injection) to compromise 900+ internet-facing applications and exfiltrate 30,000+ .env files, cloud keys, and API tokens. The operator industrialized scanning, triage, and secret validation using Claude Code and OpenClaw as an in-loop engineering harness, with Telegram bots (@bissapwned_bot, @bissa_scan_bot) for real-time alerting and a Filebase S3 bucket (bissapromax) for staging 400+ ZIP batches containing 65,000+ archived file entries. Harvested secrets span financial services, crypto custodians, retail, payroll/HR, AI platforms, cloud providers, and auth vendors, creating systemic downstream supply-chain and account-takeover risk.

- **Published:** 2026-04-22T12:00:00Z
- **Last reviewed:** 2026-04-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0411
- **ID:** TL-2026-0411
- **Severity:** HIGH (CVSS 9)
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Actor:** BonJoviGoesHard
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-55182, CVE-2025-9501

## Description

On 2026-04-22, The DFIR Report published a deep-dive disclosure of a mass-exploitation and secret-harvesting pipeline branded by its own operator as Bissa Scanner. The research team recovered the operator's internal tooling, scanner codebase, Telegram bot telemetry, and staging infrastructure after the operator inadvertently exposed a leased control-plane endpoint. The campaign is attributed — with HIGH confidence — to a single individual operating under the Telegram handles @BonJoviGoesHard and Dr. Tube, working from a Linux workstation that doubled as the scanner's orchestrator.

The operator's primary weaponization target was CVE-2025-55182 (React2Shell), a remote code execution flaw in Next.js middleware request handling that allows an unauthenticated attacker to smuggle an x-middleware-subrequest header chain, bypass authentication and middleware gating, and reach internal server-rendered routes that evaluate attacker-controlled input as JavaScript. A secondary exploit module weaponized CVE-2025-9501, an unauthenticated command-injection vulnerability in the W3 Total Cache WordPress plugin's CDN purge endpoint. The scanner fingerprinted both stacks via HTTP banner heuristics and favicon hashing, then launched exploit leases against candidate targets in staggered batches to avoid upstream rate-limiting.

Successful compromise on a Next.js target resulted in the deployment of a staged dropper that walked the application root for .env, .env.local, .env.production, next.config.js, and package.json, recursively pulled node_modules/.bin metadata, and compressed findings into a numbered ZIP (bissa-batch-NNNN.zip) uploaded to the operator's Filebase S3 bucket bissapromax. On WordPress/W3 Total Cache targets the same pipeline harvested wp-config.php, wp-content/uploads, mu-plugins, and any detected AWS/Stripe/SendGrid keys in wp_options.

The novel TTP disclosed by the report is the operator's tight coupling of Claude Code and OpenClaw as an AI-assisted engineering harness for the scanner itself — not for victim compromise, but for operator productivity. The DFIR Report recovered conversation transcripts showing the operator using Claude Code to refactor the lease/acknowledgement queueing logic, debug a race condition in the exploit-worker pool, write benchmark harnesses to rank target-generation strategies, and translate error messages from the scanner's Go-based HTTP worker into Python for triage. OpenClaw was used as a sandboxed container harness to iterate on scanner modules without polluting the operator's host. This pattern — using agentic coding assistants to compress the operator development cycle for offensive tooling — represents an inflection point in the industrialization of opportunistic mass exploitation.

Telemetry recovered from the two Telegram bots (@bissapwned_bot for hit alerts, @bissa_scan_bot for scan-queue control) confirms 900+ successful compromises across 400+ exfil batches, 30,000+ unique .env files, and 65,000+ total archived file entries. Victim geography skews toward North America and Europe, with heavy representation in financial services, cryptocurrency custodians and exchanges, retail e-commerce, and payroll/HR SaaS. Recovered harvested credentials include AWS access keys, Stripe live keys, SendGrid API tokens, Anthropic and OpenAI API keys, GitHub personal access tokens, Auth0 and Okta client secrets, and private keys for MetaMask/Coinbase/custodial wallets. At least 40 of the AWS keys were observed being reused by the operator within 24 hours for secondary enumeration against S3 and IAM, indicating hands-on-keyboard follow-through rather than pure bulk hoarding.

The DFIR Report's exposure has burned the operator's current infrastructure (Filebase bucket, Telegram bots, and the leased VPS fronting the scanner control plane), but the operator's tooling has been open enough — and replicable enough — that copycat deployment by other opportunistic actors should be expected within weeks. Defenders are urged to treat every Next.js and W3 Total Cache deployment touched during the campaign window as credential-compromised, rotate all long-lived secrets in affected environments, and deploy detections for the specific middleware-subrequest header patterns and CDN-purge exploitation traces documented below.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1592 Gather Victim Host Information
- T1583.006 Web Services
- T1587.001 Malware
- T1588.005 Exploits
- T1608.001 Upload Malware
- T1190 Exploit Public-Facing Application
- T1078.004 Cloud Accounts
- T1059.004 Unix Shell
- T1059.006 Python
- T1211 Exploitation for Stealth
- T1686 Disable or Modify System Firewall
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1552.005 Cloud Instance Metadata API
- T1083 File and Directory Discovery
- T1580 Cloud Infrastructure Discovery
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1102.002 Bidirectional Communication
- T1071.001 Web Protocols
- T1567.002 Exfiltration to Cloud Storage
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1657 Financial Theft

## Sources

- [Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting](https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/)
- [Automated Credential Harvesting Campaign Exploits React2Shell](https://www.darkreading.com/cyberattacks-data-breaches/automated-credential-harvesting-campaign-react2shell)
- [CVE-2025-55182 — Next.js React2Shell RCE](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)
- [CVE-2025-9501 — W3 Total Cache Unauthenticated Command Injection](https://nvd.nist.gov/vuln/detail/CVE-2025-9501)
- [MITRE ATT&CK — T1583.006 Acquire Infrastructure: Web Services](https://attack.mitre.org/techniques/T1583/006/)
- [Next.js Middleware Authorization Bypass Advisory](https://github.com/vercel/next.js/security/advisories)
- [W3 Total Cache CDN Purge Command Injection Advisory](https://wordpress.org/plugins/w3-total-cache/#developers)
- [CISA KEV — CVE-2025-55182 Next.js Middleware RCE](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0411