Hackers target exposed Vite dev servers to steal AWS, Azure secrets
Recorded: Sept. 14, 2026, 5 p.m.
| Original | Summarized |
Hackers target exposed Vite dev servers to steal AWS, Azure secrets News Featured Microsoft: September updates cause RDS failures on Windows Server Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent New Android malware encrypts files, steals data, and harasses victims Florida confirms DMV database breached via stolen police account Hackers target exposed Vite dev servers to steal AWS, Azure secrets Why Patch Automation Needs Brakes, Not Just an Accelerator Webinar: How malicious OAuth apps can lead to Google Workspace breaches Lifetime access to this full cybersecurity bootcamp is only $53 on sale Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityHackers target exposed Vite dev servers to steal AWS, Azure secrets Hackers target exposed Vite dev servers to steal AWS, Azure secrets By Bill Toulas September 14, 2026 A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Related Articles: Actively Exploited Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Upcoming Webinar Popular Stories Passkey-themed phishing attacks lead to Microsoft 365 data theft Hackers abused Claude to extract secrets from 1.8M Android apps GitLab urges users to patch max severity path traversal flaw Sponsor Posts Overdue a password health-check? Audit your Active Directory for free Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday. Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain Patch automation needs more than speed. Action1 brings control into every stage of deployment. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
A mass scanning campaign was identified targeting internet-exposed Vite development servers with the objective of exfiltrating cloud credentials and configurations from Amazon Web Services and Azure deployments. This operation exploited a high-severity vulnerability, CVE-2026-39364, which permits an unauthenticated attacker to bypass file read and access controls within specific versions of Vite, including versions 7.1.0 through 7.3.2, and the 8.x branch prior to 8.0.5. The flaw allows attackers to manipulate query parameters in HTTP GET requests to retrieve files in plaintext from unauthorized locations. Technology company F5 detected this malicious activity through its honeypot sensors, registering over 800 attacks and approximately 32,000 raw events over a single month. Following the initial breach, the scanning activities focused on identifying valuable secrets by employing extensive wordlists against various sensitive file types. These targets included environment files such as .env, .env.production, and .env.local, AWS credential files located in various home directories, AWS configuration and credential backups, Azure credentials and access tokens, Terraform state and variable files, serverless configuration and state data, and system environment variables like /proc/self/environ and /proc/1/environ. The attackers also attempted to access basic system files like /etc/passwd. The malicious attempts demonstrated sophisticated evasion techniques, involving traversal and various encoding variants, including double-encoded traversal sequences, presumably to circumvent reverse proxies or Web Application Firewalls through normalization processes. The majority of the observed malicious traffic originated from the United States, Belgium, and the Netherlands, with the attackers utilizing Google Cloud IP ranges to mask their origin. Furthermore, the malicious actors leveraged other existing access control weaknesses in Vite, including CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811, amplifying their ability to compromise systems. To mitigate this risk, the technology company recommends that developers update their Vite servers to the most current versions to patch the exploited flaws. Security best practices also advise developers to restrict network access by blocking traffic to port 5173, implement restrictions on suspicious requests to paths like /@fs/, and refrain from trusting information contained within User-Agent strings. If Vite servers were publicly exposed and vulnerable, it is strongly recommended that all secrets residing on those systems be immediately rotated. The report indicates that the most active malicious IP addresses used in these attempts include 34.14.15.105, 34.16.200.129, and 34.11.196.206, and these addresses should be added to blocklists. |