December 2025, the RondoDox botnet operators have been targeting Next.js servers impacted by the React2Shell vulnerability.

Markdown messages (with @mentions and font colors) Markdown V2 messages (with tables, lists, embedded images) Image messages (base64/local file/URL) File messages Template card messages (text_notice ...