Aqua describes a multistage XMRig cryptojacking campaign in containerized Node.js applications, including memory-based execution, persistence and mining traffic. The exact initial exploit was not determined, and Aqua found no evidence of access to customer secrets.
CVE-2025-55182, an unauthenticated remote-code-execution flaw in React Server Components affecting React 19 and related frameworks such as Next.js, is being actively exploited. Apply the listed patches and review dependencies.
Aqua researchers analyzed a Kaiji infection on a weak-password SSH honeypot, documenting its DDoS and proxy capabilities, persistence and evasion methods, and campaign infrastructure, including a server with more than 70,000 collective malware downloads.
Aqua Nautilus describes Koske, a Linux cryptomining malware campaign that uses image-embedded payloads, persistence mechanisms and a userland rootkit. Researchers say its modular code and adaptive behavior may indicate AI assistance.