Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers
Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data.
Cybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data. The first is an automated effort aimed at internet-exposed Vite development servers that's designed to steal cloud credentials, configurations from Amazon Web Services (AWS) and Microsoft Azure instances, and infrastructure state files, per F5 Labs.
The operation leverages an exploit for CVE-2026-39364, a high-severity vulnerability that allows bypassing file read/access controls in Vite versions 7.1.0 through 7.3.2, as well as the 8.x branch before 8.0.5. Japan's Digital Agency says VPN flaw exposed 246,000 personnel records
Technology company F5 detected the attacks through its honeypot sensors, observing more than 800 attacks and approximately 32,000 raw events over a month. “When specific parameters such as ?raw, ?import&raw, or ?import&url&inline are appended to a request, the server fails to enforce deny-list filtering and serves the target file with an HTTP 200 response,” F5 explains. After breaching a system, the scanning focused on valuable secrets by using extensive wordlists for the following types of data: F5 notes that the operation also tried traversal and encoding variants, including double-encoded traversal sequences, apparently to get past reverse proxies or WAF normalization. Although Vite normally binds to localhost, F5 researchers say that developers often expose it online through passing the --host flag, setting the server.host, or misconfigured Docker port mappings.
The top sources for the malicious attempts are 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206, which should be blocklisted.
The top sources for the malicious attempts are 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206, which should be blocklisted.
What changed
A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments.
The flaw was disclosed on April 7 and allows an unauthenticated attacker to manipulate query parameters in an HTTP GET request to bypass security restrictions and retrieve files in plaintext from locations that should normally be out of their reach.
The most active IP addresses also leveraged other access control flaws in Vite: CVE-2025-30208, CVE-2025-31125 ( flagged as actively exploited ), and CVE-2024-45811.
The technology company recommends updating Vite servers to the latest version, which addresses the exploited flaws.
Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments.
The first campaign, per the tech giant, involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers
Who is affected
Technology company F5 detected the attacks through its honeypot sensors, observing more than 800 attacks and approximately 32,000 raw events over a month.
“When specific parameters such as ?raw, ?import&raw, or ?import&url&inline are appended to a request, the server fails to enforce deny-list filtering and serves the target file with an HTTP 200 response,” F5 explains.
After breaching a system, the scanning focused on valuable secrets by using extensive wordlists for the following types of data: F5 notes that the operation also tried traversal and encoding variants, including double-encoded traversal sequences, apparently to get past reverse proxies or WAF normalization.
Although Vite normally binds to localhost, F5 researchers say that developers often expose it online through passing the --host flag, setting the server.host, or misconfigured Docker port mappings.
Developers should also block access through port 5173, block suspicious /@fs/ requests, and avoid trusting crawler User-Agent strings.
Why this matters
The operation leverages an exploit for CVE-2026-39364, a high-severity vulnerability that allows bypassing file read/access controls in Vite versions 7.1.0 through 7.3.2, as well as the 8.x branch before 8.0.5.
Japan's Digital Agency says VPN flaw exposed 246,000 personnel records
What defenders should do now
The top sources for the malicious attempts are 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206, which should be blocklisted.
What to watch next
Watch for additional exploitation reporting, newly published indicators, and changes to vendor guidance.