Bissa Scanner — AI-Assisted Mass Exploitation of CVE-2025-55182 (React Server Components RCE) and CVE-2025-9501 (W3 Total Cache)
Bissa Scanner (TL-2026-0428), also tracked as Bissa Scanner, is a critical-severity software vulnerability scored CVSS 10, first published 2026-04-27. It is attributed to BonJoviGoesHard with high confidence, affects Meta / React React Server Components (react, react-dom, references 2 CVEs (CVE-2025-55182, CVE-2025-9501), maps to 29 MITRE ATT&CK techniques (T1005, T1041, T1059.004), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-0428
- Threat ID
- TL-2026-0428
- Also known as
- Bissa Scanner, BissaPwned, React2Shell campaign, bissapromax operation
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- 2026-04-27
- Last reviewed
- 2026-04-27
- Attribution
- BonJoviGoesHard
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- financial, fintech, payments, payroll, tax-services, cryptocurrency, saas, e-commerce, retail, hr-tech, developer-tools
- Target regions
- North America, Europe, Asia, Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Bissa Scanner
Malware and tooling: Bissa Scanner (bissascanner / bissa_bench / bissapromax), Claude Code (claude-sonnet-4-6), OpenClaw, Telegram Bot API (api.telegram.org)
AI-orchestrated mass-exploitation and credential-harvesting campaign operated by Telegram handle @BonJoviGoesHard (Dr. Tube). The scanner abuses CVE-2025-55182 (React Server Components / Next.js pre-auth RCE, CVSS 10.0) and CVE-2025-9501 (W3 Total Cache unauthenticated command injection, CVSS 9.0) at internet scale, yielding 900+ confirmed React2Shell compromises and 30,000+ exfiltrated .env files (65,000+ archived entries) staged in three Filebase S3 buckets — bissa, bissa2, bissapromax. Stolen secrets span AI providers (Anthropic, OpenAI, Google, Mistral, OpenRouter, Groq, Replicate, DeepSeek, HuggingFace), all major clouds (AWS, GCP/Firebase, Azure, Cloudflare, DigitalOcean, Alchemy), payments (Stripe, PayPal, Shopify, Square), banking (Plaid), crypto custody (Fireblocks), auth (Auth0/Okta, Clerk), and source control (GitHub). The operator embedded Claude Code (claude-sonnet-4-6) and OpenClaw into day-to-day scanner refinement and exploit triage.
How Bissa Scanner works
Bissa Scanner is an active, lone-operator mass-exploitation framework that weaponizes CVE-2025-55182 — a CVSS 10.0 pre-auth remote code execution flaw in React Server Components (RSC) bundlers and routing infrastructure used by Next.js, Remix, and other RSC-aware frameworks — together with CVE-2025-9501, a CVSS 9.0 unauthenticated command-injection issue in WordPress plugin W3 Total Cache (versions <2.8.13). The campaign is run by Telegram user @BonJoviGoesHard (display name ''Dr. Tube'', User ID 1609309278) and supported by an automated bot army centered on @bissapwned_bot (Bot ID 8798206332) for victim alerting and @bissa_scan_bot for AI-control orchestration.
The scanner ingests target lists from acquirer endpoints — most recently denemekulubum.com.tr/acquirer/ (formerly wiprz.com/acquirer/) and target feeds distributed via cs2.ip.thc.org — and assigns work via lease files keyed to exploit modules (e.g., cve_2025_55182). After RCE is achieved, payloads enumerate .env files, cloud metadata services (AWS IMDS, GCP metadata, Azure IMDS), Kubernetes service-account tokens, credential stores, database/Redis access, and cryptocurrency wallets. Harvested .env files land in a results/ directory on the operator''s scanner hosts where a watcher batches them into env-batch-*.zip archives and uploads to Filebase (s3.filebase.com) under the bissa, bissa2, and bissapromax buckets. Bissa was first stood up September 2025; bissa2 in November 2025; bissapromax in December 2025 — the latter remains the active live archive. Telegram alerts deliver per-hit notifications to chat ID 1609309278.
Forensic recovery from the exposed buckets surfaced 13,000+ files across 150+ directories, 400+ raw env-batch-*.zip objects, 30,000+ distinct .env filenames, and 65,000+ archived file entries. The intensive harvesting window observed ran April 10–21, 2026, immediately preceding The DFIR Report''s public exposure on 2026-04-22. Confirmed victim profiles include: a mid-sized US tax-resolution and financial-advisory firm (Plaid tokens, linked bank accounts, IRS transcripts, ACH records, Twilio call logs, Salesforce contacts, SSN/DOB case data); a large digital-asset and enterprise-finance company (authenticated Oracle Fusion REST exports — suppliers, invoices, POs, payments, bank accounts); and a mid-sized payroll/HR/stablecoin payments platform (payroll records, settlement data, Fireblocks integration material, HRIS data).
The most novel element is the operator''s integration of large-language-model tooling into the offensive workflow. Claude Code (claude-sonnet-4-6) was used for scanner code review, troubleshooting, and documentation, while OpenClaw provided a local AI-control surface with a websocket gateway and browser automation layer for exploit triage. A helper script, claude_env_fix.sh, was used to repair malformed .env captures before secret-harvest parsing. This places Bissa in a small but growing class of offensive operations using consumer LLM coding agents as productivity multipliers for scanner development and triage.
Downstream blast radius is severe: harvested credentials enable full takeover of the victim''s AWS, GCP, Azure, Cloudflare, Stripe, PayPal, Auth0/Okta, Clerk, Supabase, MongoDB, Plaid, Fireblocks, and GitHub tenants — meaning the campaign functions as an enabler for ransomware, BEC, payment fraud, crypto theft, and supply-chain compromise via stolen GitHub tokens. CVE-2025-55182 was added to the CISA Known Exploited Vulnerabilities catalog on 2025-12-05 with a 2025-12-19 federal remediation deadline; W3 Total Cache CVE-2025-9501 has been observed under active exploitation since the v2.8.13 patch in early 2026. Defenders should patch RSC-using applications to the React 19.x security release line and W3 Total Cache to >=2.8.13, block egress to s3.filebase.com from production tenants where unjustified, hunt for env-batch-*.zip and claude_env_fix.sh artifacts on web-tier hosts, rotate every secret class listed in this advisory, and treat any Plaid/Stripe/Fireblocks key recovered from a compromised .env as already-burned.
MITRE ATT&CK techniques used in TL-2026-0428
Collection
T1005 Data from Local System; T1119 Automated Collection; T1560.001 Archive Collected Data: Archive via Utility
Exfiltration
T1041 Exfiltration Over C2 Channel; T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service; T1567.002 Exfiltration to Cloud Storage
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.007 Command and Scripting Interpreter: JavaScript
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.002 Web Service: Bidirectional Communication
Privilege Escalation
Persistence
T1078.004 Valid Accounts: Cloud Accounts
Discovery
T1083 File and Directory Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery; T1613 Container and Resource Discovery
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1552.007 Unsecured Credentials: Container API
Resource Development
T1583.006 Acquire Infrastructure: Web Services; T1587.004 Develop Capabilities: Exploits; T1588.002 Obtain Capabilities: Tool
Reconnaissance
T1592 Gather Victim Host Information; T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning
Impact
Affected products and versions in Bissa Scanner
- Meta / React — React Server Components (react, react-dom, react-server-dom-webpack)
Vulnerable versions: 19.0.0 - 19.x pre-fix
Fixed in: React 19.x security release per react.dev/blog/2025/12/03 - Vercel — Next.js (App Router with RSC)
Vulnerable versions: 13.x - 15.x with vulnerable React
Fixed in: Next.js versions adopting patched React 19.x - Shopify — Remix / React Router (RSC adopters)
Vulnerable versions: RSC-enabled builds prior to fix
Fixed in: Builds with patched react-server-dom - BoldGrid — W3 Total Cache (WordPress plugin)
Vulnerable versions: < 2.8.13
Fixed in: 2.8.13
Remediation for Bissa Scanner
Patches
- React 19.x security release fixing CVE-2025-55182 (RSC payload deserialization)
- Next.js patch versions adopting fixed React (refer to Vercel security advisory for matrix)
- W3 Total Cache 2.8.13+ (CVE-2025-9501)
Immediate actions
- Patch all React Server Components / Next.js / Remix applications to the React 19.x security release that fixes CVE-2025-55182; redeploy with cache-busting build IDs
- Patch WordPress W3 Total Cache plugin to >=2.8.13 (CVE-2025-9501); audit cron tasks and active filters for injected commands
- Block egress to s3.filebase.com (and all *.filebase.com) from production web/app tiers unless explicitly required; alert on any HTTP CONNECT or TLS SNI matches
- Treat any AI/cloud/payment/auth/banking secret present in a compromised .env file as already exfiltrated — rotate immediately and revoke active sessions
- Hunt web-tier hosts for env-batch-*.zip, claude_env_fix.sh, /bissascanner/ paths, and outbound Telegram bot-API calls
Workarounds
- Disable Server Components / RSC streaming for affected routes if patching is delayed; serve via static export or pure client components
- Place RSC apps behind a WAF rule that blocks malformed RSC payload structures (Cloudflare and Akamai have published managed rules)
- Deactivate W3 Total Cache plugin on WordPress sites that cannot patch immediately; clear page cache
Longer-term hardening
- Remove plaintext secrets from .env files; move to a secret manager (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault, Doppler) with short-lived tokens
- Apply least-privilege IAM with workload identity for compute; disable IMDSv1 and require IMDSv2 with hop-limit 1 on AWS
- Implement SSRF and metadata-endpoint protections at the application layer; block 169.254.169.254 from RSC-rendered server fetches
- Deploy egress allow-listing for production application tiers; alert on first-seen S3-compatible upload destinations
- Roll out webhook secret rotation automation and short-lived OAuth tokens for all third-party integrations (Stripe, Plaid, Twilio, GitHub Apps)
- Add CI/CD secret scanning on every commit and every container image build; fail builds on detected secrets
CVEs associated with Bissa Scanner
Weaknesses (CWE) in Bissa Scanner
CWE-502, CWE-78, CWE-77, CWE-200, CWE-918
Timeline of Bissa Scanner
- Operator @BonJoviGoesHard provisions first Filebase S3 bucket bissa for staging exfiltrated .env archives.
- Secondary Filebase bucket bissa2 stood up; scanner tooling iterates as collection volume grows.
- Meta and the React core team disclose CVE-2025-55182, a CVSS 10.0 pre-auth RCE in React Server Components affecting Next.js, Remix, and other RSC-aware frameworks; React 19.x security release published.
- CISA adds CVE-2025-55182 to the Known Exploited Vulnerabilities catalog with a 2025-12-19 federal remediation deadline; mass exploitation already observed in the wild.
- Filebase bucket bissapromax established and becomes the live archive for env-batch-*.zip uploads through April 2026.
- Bissa scanner adds exploit module for CVE-2025-9501 (W3 Total Cache <2.8.13 unauthenticated command injection, CVSS 9.0); WordPress shops join the target pool alongside RSC apps.
- Intensive .env collection window begins; 13,000+ files across 150+ directories and 400+ env-batch-*.zip objects accumulate in bissapromax over the next eleven days.
- Operator collection window observed by responders ends; 30,000+ unique .env filenames and 65,000+ archived file entries recovered from exposed bucket listings.
- The DFIR Report publishes ''Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting'', attributing the operation to @BonJoviGoesHard / Dr. Tube and detailing Claude Code + OpenClaw integration.
- SOCPrime publishes corroborating analysis with Sigma detection content; community begins ingesting bissa IOCs into TI feeds.
- Threadlinqs Intelligence publishes TL-2026-0428 with full IOC, MITRE, detection, and simulation coverage.
- As of 2026-05-29, Bissa's known infra (Filebase buckets, Telegram bots) was burned by The DFIR Report's 2026-04-22 exposure and collection went quiet, but operator @BonJoviGoesHard is unarrested and could rebuild. Both abused CVEs stay live: CVE-2025-55182 (React2Shell) is in CISA KEV and broadly exploited; CVE-2025-9501 leaves ~327k+ WordPress sites unpatched.
Sources cited for Bissa Scanner
- The DFIR Report — Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting
- NVD — CVE-2025-55182
- React Blog — Critical Security Vulnerability in React Server Components
- Facebook Security Advisory — CVE-2025-55182
- SOCPrime — Bissa Scanner Automates Exploitation and Credential Theft
- CISA KEV Catalog — CVE-2025-55182
- NVD — CVE-2025-9501 (W3 Total Cache)
- Filebase Documentation — S3-Compatible Object Storage
Threats related to Bissa Scanner
- Bissa Scanner — AI-Assisted Mass Exploitation and Credential Harvesting Campaign (@BonJoviGoesHard / Dr. Tube)
- PCPJack Worm — Cloud Credential Theft Framework Evicting TeamPCP Infections (CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, CVE-2025-48703)
- Gitea Container Registry Authorization Bypass (CVE-2026-27771) — Unauthenticated Pull of Private Container Images Across 31,000+ Self-Hosted Instances
- OpenAI Models Chain Eight JFrog Artifactory Zero-Days to Escape Sandbox and Breach Hugging Face
- LMDeploy SSRF in load_image() Vision-Language Module (CVE-2026-33626) — Actively Exploited Within 13 Hours of Disclosure
- Escalating Kubernetes Attacks: React2Shell (CVE-2025-55182), Slow Pisces, and Cloud-Native Threat Actors
Detection coverage for TL-2026-0428
As of 2026-04-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0428 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.