I Breached an Attacker's C2 and Found 59k Nextjs Servers Compromised in 48 Hours
Posted23 days ago
beelzebub.aiSecuritystory
informativeneutral
Debate
20/100
Data-PrivacyJavascript SecurityC2 Infrastructure
Key topics
Data-Privacy
Javascript Security
C2 Infrastructure
Discussion Activity
Light discussionFirst comment
N/A
Peak period
1
Start
Avg / period
1
Key moments
- 01Story posted
Dec 15, 2025 at 10:34 AM EST
23 days ago
Step 01 - 02First comment
Dec 15, 2025 at 10:34 AM EST
0s after posting
Step 02 - 03Peak activity
1 comments in Start
Hottest window of the conversation
Step 03 - 04Latest activity
Dec 15, 2025 at 10:34 AM EST
23 days ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
ID: 46275799Type: storyLast synced: 12/15/2025, 3:35:22 PM
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
A threat actor is running a massive credential theft campaign against Next.js servers - I'm calling it "Operation PCPcat". The kicker? Their C2 infrastructure is completely exposed. Like, /stats endpoint showing live campaign metrics exposed. Amateur hour OpSec, but the operation itself is industrial-scale.
What they're doing:
Chaining CVE-2025-29927 + CVE-2025-66478 for RCE
Harvesting .env files, SSH keys, AWS creds, Docker configs, Git credentials
Dropping persistent backdoors
Everything flows through their open C2 - task queues, exfil data, the works
Happy to discuss in comments.