UAT-10608Threat actor
UAT-10608 is a threat cluster observed by Cisco Talos conducting a large-scale, automated credential-harvesting campaign against public-facing web applications, especially Next.js deployments, using a custom framework called NEXUS Listener to extract and exfiltrate secrets such as credentials, SSH keys, cloud tokens, and API keys.From MISP Galaxy
Last reported 27 days ago, by CERT-EU1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1036Masquerading
“Attributed to threat actor idbzoomh, the campaign used a malicious archive masquerading as leaked source code to deliver Vidar v18.7, an information stealer, and GhostSocks, a SOCKS proxy trojan.”
- T1195Supply Chain Compromise
“On April 25, a supply-chain compromise reportedly targeted the elementary-data project, where a forged release was published to PyPI and a matching trojanised container image was pushed to the GitHub Container Registry.”
- T1555.005Password Managers
“The campaign impersonated legitimate developer tooling to deliver RAT-enabled infostealers targeting credentials, browser data, password managers, and cryptocurrency wallets.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Cyber Brief 26-05 - April 2026“UAT-10608 large-scale automated credential harvesting via React2Shell”
Thanks — we review every report.