Attackers weaponized the developer toolchain this week (again!). GitHub repositories masquerading as OSINT tools sat on trending lists for months before dropping RATs on security professionals. React Server Components—the framework primitive powering modern web applications—went from vulnerability disclosure to 35,000 daily exploitation attempts in seven days, forcing CISA to issue emergency deadlines. Microsoft patched a Windows kernel driver zero-day that was already being exploited in the wild to escalate from user to SYSTEM privileges. The common thread isn’t opportunistic scanning; it’s systematic targeting of trusted platforms, development tools, and framework-level primitives that defenders assume are secure by default.

This week: three incidents showing how supply chain attacks have moved upstream from npm packages to GitHub trending algorithms, why your React applications need emergency patching, and what a Windows kernel compromise looks like when Microsoft won’t tell you who’s exploiting it or how.

PyStoreRAT GitHub Supply Chain Campaign

What happened:

Threat actors weaponized GitHub repositories disguised as OSINT tools, DeFi bots, GPT wrappers, and security utilities to distribute PyStoreRAT, a JavaScript-based Remote Access Trojan, and Rhadamanthys infostealer. Repositories artificially inflated stars/forks to land on GitHub trending lists before malicious “maintenance” commits added loaders in October-November.

Technical details that matter:

• Initial Access: Loader stubs embedded in Python/JavaScript projects execute remote HTA payload via mshta.exe, with detection evasion for CrowdStrike Falcon and Cybereason/ReasonLabs (launches via cmd.exe if detected, otherwise direct execution)
• Execution: HTA payload delivers PyStoreRAT RAT capable of executing EXE, DLL, PowerShell, MSI, Python, JavaScript, and HTA modules
• Persistence: Scheduled task masquerading as “NVIDIA app self-update”
• C2 Architecture: Modular command structure supporting dynamic code execution (eval() for JavaScript), DLL sideloading via rundll32.exe, in-memory PowerShell, MSI installations
• Lateral Movement: Removable drive propagation by replacing legitimate documents with malicious LNK files
• Collection: Targeted cryptocurrency wallet files (Ledger Live, Trezor, Exodus, Atomic, Guarda, BitBox02)
• Exfiltration: Rhadamanthys payload for credential and data theft
• Defense Evasion: Scheduled task deletion to remove forensic trail, Russian-language artifacts suggest Eastern European origin

Why you should care:

GitHub-hosted supply chain attacks exploit inherent platform trust and developer workflows. The campaign demonstrates sophisticated social engineering through trending list manipulation and delayed payload insertion after gaining credibility. Security and IT professionals attracted to OSINT/GPT tools represent high-value targets with privileged access. The modular RAT architecture enables rapid pivot from initial compromise to data exfiltration and lateral movement, with cryptocurrency focus indicating financially-motivated actors capable of retooling for enterprise targeting.

Key sources:

• https://www.morphisec.com/blog/pystorerat-a-new-ai-driven-supply-chain-malware-campaign-targeting-it-osint-professionals/
• https://thehackernews.com/2025/12/fake-osint-and-gpt-utility-github-repos.html
• https://ti.qianxin.com/blog/articles/setcoderat-customized-for-chinese-speaking-regions-en/

React2Shell Exploitation Escalation (Post-December 5 Developments)

What happened:

CVE-2025-55182 exploitation exploded from disclosure (Dec 3) to emergency-level response, forcing CISA to revise federal deadline from December 26 to December 12 (today). Kaspersky recorded 35,000+ exploitation attempts on December 10 alone. Security researchers discovered open directory containing PoC exploit and 35,423 target domains including Fortune 500 companies.

Technical details that matter:

• Reconnaissance: Threat actors conducted mass scanning using Shodan/Censys excluding Chinese IP spaces, with highest density targeting Taiwan, Xinjiang, Vietnam, Japan, New Zealand (geopolitical intelligence priorities)
• Target Selection: Government (.gov) websites, academic research institutions, critical infrastructure operators including national uranium/nuclear fuel import/export authority, enterprise password managers, secure vault services (supply chain attack positioning)
• Exploitation Vectors: Edge-facing SSL VPN appliances with React-based admin interfaces, containerized workloads in Kubernetes, managed cloud services
• Post-Exploitation: Cryptocurrency miners (immediate monetization), Mirai/Gafgyt botnet variants, RondoDox malware, PeerBlight Linux backdoor, CowTunnel reverse proxy, ZinFoq Go-based implant
• Scale: 137,200+ internet-exposed vulnerable instances as of December 11 (88,900 in US, 10,900 Germany, 5,500 France, 3,600 India)
• Operational Security: Open directory at 154.61.77[.]105:8082 contains exploit script, domains.txt (35,423 targets), next_target.txt (596 URLs including Starbucks, Porsche, Lululemon)

Why you should care:

React2Shell represents a fundamental trust boundary violation in modern web frameworks affecting Next.js, Waku, Vite, React Router, and RedwoodSDK. The unauthenticated RCE requires zero user interaction; a single HTTP request achieves privileged JavaScript execution. Exploitation patterns demonstrate adversary prioritization of high-sensitivity targets (government, critical infrastructure, technology supply chain) with operational sophistication (geopolitical targeting exclusions, SSL VPN pivots). The 10-day window from disclosure to emergency deadline revision indicates unprecedented exploitation velocity and impact severity.

Key sources:

• https://blog.cloudflare.com/react2shell-rsc-vulnerabilities-exploitation-threat-brief/
• https://www.wiz.io/blog/nextjs-cve-2025-55182-react2shell-deep-dive
• https://securelist.com/cve-2025-55182-exploitation/118331/
• https://theravenfile.com/2025/12/12/react2shell-exploitation-in-the-wild/
• https://www.cisa.gov/news-events/alerts/2025/12/05/cisa-adds-one-known-exploited-vulnerability-catalog
• https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=http_vulnerable

Microsoft Windows Zero-Day CVE-2025-62221

What happened:

Microsoft patched an actively exploited use-after-free elevation of privilege vulnerability in Windows Cloud Files Mini Filter Driver enabling local attackers to achieve SYSTEM-level compromise. Exploitation confirmed in wild attacks but Microsoft disclosed no operational details. CISA mandated federal agency patching by December 30.

Technical details that matter:

• Vulnerability Class: Use-after-free in Windows Cloud Files Mini Filter Driver (present even without OneDrive/Google Drive/iCloud installations)
• Exploit Requirements: Authenticated local access, low privileges, no user interaction, low attack complexity (CVSS 7.8)
• Attack Chaining: Ideal second-stage exploit after initial access via phishing, web browser exploit, or remote code execution; chain with CVE-2025-62221 for full host control
• Privilege Escalation: Direct path to SYSTEM privileges enabling kernel component deployment, signed driver abuse for defense evasion, credential theft for domain-wide compromise
• Affected Systems: Every supported Windows version (Windows 10, 11, Server 2016-2025)
• Operational Context: Part of 57-vulnerability December 2025 Patch Tuesday (3 zero-days total), Microsoft patched 1,275 CVEs in 2025 (second consecutive year >1,000)
• Attribution: Discovered internally by Microsoft Threat Intelligence Center (MSTIC) and Security Response Center (MSRC), suggesting detection during active compromise investigation

Why you should care:

Minifilter driver vulnerabilities provide attackers with privileged access to file system operations, enabling comprehensive host control and detection evasion. The use-after-free class indicates memory corruption exploitable for arbitrary code execution in kernel context. Active exploitation pre-disclosure suggests sophisticated adversary capability and operational motivation. Microsoft’s silence on attack details combined with CISA KEV listing signals serious real-world impact. Post-compromise attack chains combining this privilege escalation with credential theft enable rapid domain-wide compromise in enterprise environments.

Key sources:

• https://www.bleepingcomputer.com/news/microsoft/microsoft-december-2025-patch-tuesday-fixes-3-zero-days-57-flaws/
• https://socprime.com/blog/cve-2025-62221-and-cve-2025-54100-vulnerabilities/
• https://www.tenable.com/blog/microsofts-december-2025-patch-tuesday-addresses-56-cves-cve-2025-62221
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-62221
• https://thehackernews.com/2025/12/microsoft-issues-security-fixes-for-56.html

The Pattern this Week

Adversaries are targeting trust relationships in the development and deployment stack. PyStoreRAT operators understood that security professionals download OSINT tools from GitHub without the same scrutiny they apply to production dependencies. React2Shell attackers knew that web frameworks are deployed everywhere but patched slowly. The Windows kernel exploit operators recognized that privilege escalation vulnerabilities chain perfectly with initial access to achieve full domain compromise.

The defender’s problem: you can’t patch GitHub’s trust model, you can’t verify every framework primitive before deployment, and you can’t detect kernel-level privilege escalation if you’re not monitoring for the specific memory corruption patterns. When the platform itself is the vulnerability, your detection stack is looking in the wrong place.

See you next week.