AI-Generated Malware Exploits React2Shell for Tiny Profit

Security researchers detected artificial intelligence-generated malware exploiting the React2Shell vulnerability, allowing attackers with no coding expertise to build functional exploits. The campaign compromised 91 hosts.

See Also: The Power of Peer-to-Peer Communities

Tracked as CVE-2025-55182, React2Shell is a vulnerability in Next.js server components that allows attackers to remotely execute arbitrary commands on affected systems. The flaw provides immediate code execution capabilities once exploited.

Researchers from Darktrace say they saw the hacking activity when it came for a deliberately exposed Docker daemon in the firm’s network of honeypots. The attacker spawned a container called python-metrics-collector and used it to download and execute a Python script that exploited React2Shell.

The malware contained extensive code comments and documentation, including a header stating “Educational/Research Purpose Only.” Thorough documentation is not common in malware samples, which are typically designed to be difficult to analyze. Quick scripts written by human operators generally prioritize speed and functionality over clarity, whereas large language models document all code thoroughly by design.

When researchers tested the script using AI detection tool GPTZero, the results indicated a 76% probability that the code was generated using an LLM. The educational disclaimer suggests the attacker circumvented an AI model’s safeguards by framing the malicious request as homework.

The exploitation toolkit was technically competent. It used an IP generation loop to identify potential targets, then executed a crafted payload that confirmed host vulnerability by running the whoami command before downloading XMRig cryptocurrency mining software from GitHub.

The campaign infected 91 hosts and generated 0.015 monero since its inception, worth about 5 British pounds sterling. Daily earnings amount to roughly 1.33 pounds. The figures were traceable because the attacker used the SupportXMR mining pool, which publicly publishes statistics for each wallet address despite monero’s opaque blockchain.

Nathaniel Jones, vice president of security and AI strategy at Darktrace, said cloud infrastructure faces the most immediate risk from LLM-generated malware. “LLMs are already generating functional remote-code-execution payloads, even when the attacker doesn’t really understand the protocol or the environment,” Jones told Information Security Media Group.

Cloud services expose application programming interfaces by design. Combined with language models lowering the barrier to entry and reducing exploit development time, they become an obvious target.

The malware itself showed operational weaknesses that made it easy to disrupt. It lacked self-propagation and relied on centralized infrastructure for distribution. The script downloaded Python packages from Pastebin and the main payload from a link that redirected to a GitHub Gist hosted by user “hackedyoulol,” who has since been banned from the platform. The connection originated from an IP address registered to a residential internet service provider in India, suggesting the attacker may have been running the spreading script from a home computer.

Jones said these weaknesses will likely disappear as attackers become more proficient with AI tools. “As attackers get better at using AI, you should expect more autonomous behavior, better propagation and fewer obvious operational mistakes,” he said.

The campaign demonstrated that certain attack stages still resist full automation, Jones said. Targeting a specific organization still requires judgment and experience, particularly for lateral movement, privilege escalation and navigating identity controls. “An autonomous agent attack needs to understand what endpoint detection and response is going to do, what network detection and response is going to do, how network segmentation changes things and that’s very environment-specific,” he said.

But Jones said organizations are underestimating how quickly AI is collapsing attacker skill requirements. “You no longer need to be deeply technical to produce something that works,” he said. “That changes the threat landscape significantly.”

Many defenders rely on legacy detection models built around static signatures and assumptions about what advanced malware looks like, approaches that may not hold up when language models continuously generate and iterate tooling.

“The script kiddie that can use an AI LLM to generate malware, ok, but we are in that era now,” he said. “Rethinking means thinking how we should anticipate both advanced attacks like nation-states are going to be using it: training agents on previously successful intrusions, autonomous, multi-agent attacks, adaptive malware that doesn’t just execute a payload but adapts inside the environment.”