React2Shell Exploited in Large-Scale Credential Harvesting Campaign