Datadog Security Research

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenSep 18, 2026
Last mentionedSep 18, 2026

Timeline

1 articles · newest first

Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms

Datadog researchers document two unauthenticated, AI-built credential harvesting dashboards, Loot and UltraVault, holding 42,000+ stolen secrets and actively abusing AWS and AI keys.

Datadog Security LabsSep 18, 00:00 UTC · Sep 18, 2026ResearchExploitedCVE-2025-55182 CVE-2026-63030 CVE-2026-60137+22 · 2 reads

Related CVEs

by mentions

CVE-2026-4890785%10.0
Unauthenticated PHP Code Upload and Execution in Joomla Content Editor (JCE)
published Jun 5, 2026Widget Factory Limited Joomla Content Editor (JCE)KEVPoC ×3
CVE-2025-55182100%10.0
Unauthenticated RCE in React Server Components (React2Shell)
published Dec 3, 2025Meta (Facebook) React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack)KEVRansomwarePoC ×13
CVE-2026-6303011%9.8
WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
published Jul 17, 2026WordPress CoreKEVPoC ×7
CVE-2026-601375%5.9
WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
published Jul 17, 2026WordPress CoreKEV
CVE-2026-6463831%8.9
Pre-Auth Reflected XSS in WordPress Login Screen Can Escalate to RCE
published Aug 7, 2026WordPress core

Appears with

Reconmalware · 1
Lootproduct · 1
Geminiproduct · 1
Google Threat Intelligence Grouporganization · 1
AWSproduct · 1
Amazon Bedrockproduct · 1
Googlevendor · 1
OpenAIvendor · 1
Datadogvendor · 1
OpenAI APIproduct · 1
UltraVaultproduct · 1
Anthropicvendor · 1
Amazon Web Servicesvendor · 1

Entities are extracted by the model from each article. First seen Sep 18, 2026, last mentioned Sep 18, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.