Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms

Since July 2026, the Datadog Security Research team has been monitoring a set of credential harvesting platforms that inventory, validate, and take additional actions using compromised credentials.

Two credential harvesting platforms stand out, and at times they are served from the same host. The first, which we refer to as Loot, is a simple credential catalog with a search box and an interactive validate button. The second, UltraVault, is a dashboard that provides one-click buttons for validation of credentials, determines the best exploit to deploy against a vulnerability based on the compromised infrastructure, and potentially applies the vulnerability to the compromised host.

We reviewed 17 distinct capabilities across the UltraVault and Loot frontends. Roughly a third of capabilities are directly shown in the frontend source, giving us high confidence that the capability exists. Another third consists of the UI sending a server-side action request, while the remaining third is backend-reported results rendered in the UI.

When we observed the platforms, they were accessible without authentication. Anyone who found them could browse every credential they hold, search by victim domain, and filter by category. Both distinguish between live, pending, and dead credentials, and both re-probe keys they have already stolen—activity that is indicative of active usage.

This research follows a related finding published by Google Threat Intelligence Group (GTIG), which documented an exposed command and control (C2) server hosting an automated reconnaissance and credential management framework dubbed “Recon.” GTIG described the host as providing “a live, production frontend dashboard designed to organize, validate, and manage over 23,800 harvested secrets in real time, including API keys for cloud and AI services.”

The dashboards we describe below are different platforms, but they reflect the same shift GTIG identified: Attackers are using AI to build and visualize their infrastructure more quickly, including using it to automate their work from reconnaissance to validation to minting new credentials.

Key points and observations

• We have observed an increase in credential harvesters that treat LLMjacking as a product category, alongside cloud, SaaS, and database access.
• The attacker infrastructure regularly re-probes compromised credentials to confirm that secrets are still valid. The UltraVault operator’s own inventory has claimed 42,286 secrets, of which only 2.7% are listed as live within the platform.
• The dashboards are vibe coded. They bear the hallmarks of LLM-assisted development, including emoji-labeled action menus and AI-generated exploitation recommendations.
• From the host serving these dashboards, we see the probing behavior in action through live Amazon Bedrock abuse using GetCallerIdentity, ListFoundationModels, and InvokeModel calls.

The Loot dashboard

Loot is the simpler credential harvesting platform of the two: a category-navigable index of credentials, all displayed in plaintext, with a search field that returns groups of secrets by victim domain or type. With the Loot dashboard, we don't get any indication on how the credentials ended up in the platform.

The parsing quality is poor. The platform regularly misclassifies credentials, and the credentials field frequently contains strings that are not credentials at all. Even so, many entries are genuine, valid credentials.

One of the largest categories sits under AI. The AI category holds 1,778 records with 196 live, spanning 15 provider labels. For each record, Loot displays the victim domain, the secret, a status, and whether credits are available.

The dashboard’s own summary for the AI category:

{"ai":{"total":1778,"live":196,
"providers":{"openai":{"count":699,"live":93},"gemini":{"count":666,"live":55},
"anthropic":{"count":114,"live":10},"azure_openai_key":{"count":99,"live":0},
"openrouter":{"count":56,"live":4},"groq":{"count":35,"live":13},
"elevenlabs":{"count":32,"live":11},"deepseek":{"count":20,"live":2},
"replicate":{"count":17,"live":0},"xai":{"count":15,"live":1},
"perplexity":{"count":9,"live":1},"huggingface":{"count":9,"live":1},
"mistral":{"count":5,"live":4},"cohere":{"count":1,"live":1},
"azure_openai":{"count":1,"live":0}}}}

As an example, the OpenAI tab enumerates the models the key can reach, identifies the best available model, and confirms whether credits remain.

The UltraVault dashboard

UltraVault provides similar functionality with more sophistication and an added operations layer. As with Loot, the dashboard provides context on all credentials collected and which are deemed live, with a live rate of 2–3%.

UltraVault gives us insight into the exploits that may have resulted in credentials being captured. The interface groups targets under five named exploitation chains: react2shell (CVE-2025-55182), wp2shell (CVE-2026-63030 and CVE-2026-60137), xss2shell (CVE-2026-64638), joomla2shell (CVE-2026-48907), and deep.

An operator can test individual credentials or entire categories through /api/credentials/validate and /api/credentials/validate_category, and receive back live, dead, pending, or unchecked classifications.

UltraVault has dedicated endpoints for correlating and validating AWS secrets, indicating a more substantial focus on AWS:

1. /api/pairs correlates access-key and secret-key records that were collected separately and scattered across different dumps.
2. /api/actions/aws_pair submits a reconstructed pair and displays the resulting account ID, ARN, and region.

Escalation and the local privilege escalation (LPE) matrix

From the target panel, the Escalate tab displays the victim domain, the chain of secrets available for it, and the credentials themselves, with an option to re-check whether the access is still valid. The chain field gives us a clue on how the credentials may have been obtained.

Clicking on a domain triggers a detailed side panel view that walks through 14 LPE vulnerabilities and produces a final recommendation for a specific host.

Every one of these LPE bugs requires the attacker to already hold some level of access. The LPE matrix’s role in this side panel is to provide specific confirmation on where to spend resources with go and no-go verdicts. The last in the list is the final recommended exploit against this victim host. One-click automation can take actions on behalf of the operator directly from this view.

UltraVault provides options for both wp_reshell and wp_rexploit, which attempt to re-establish code execution on WordPress targets using known administrator credentials or a WordPress exploitation workflow. xss_admin runs predefined post-exploitation checks. If the shell dies, the operator attempts to re-open it.

The react2shell chain includes a cloud pivot, where rsc_escalate reports back cloud and internal-network reconnaissance requested from a compromised Node process. This may include metadata on endpoints, credential presence, security files, internal open ports, Kubernetes reachability, AWS SDK access, account ID, and role. The frontend code shows the interactive capability, but without access to further logging we cannot confirm that the metadata, Kubernetes, or cloud credentials were successfully reached when using these exploits.

Hosting panels and minted accounts

The Panel tab lets an operator pivot into one victim host’s identity and get all information in one place. It lists relevant API tokens and minted credentials, and provides one-click offensive actions.

In the image below, the attack targets port 2083, associated with cPanel. The side panel interaction provides the ability to validate credentials, copy credentials the attacker minted on the host, and the one-click probe for exploitability.

With all the tooling available across the UltraVault platform, the site data suggests a robust post-exploitation platform, which is a notable change from the simpler Loot platform.

To summarize, this platform displays and enables:

• Aggregated stolen secrets
• Validated credentials
• Establishment of persistence through minted credentials
• Dispatch of commands to web shells via its backend
• Attempts to re-exploit targets
• Easy export functionality

LLMjacking in practice: Amazon Bedrock credential validation

The dashboards demonstrate the collection of critical cloud credentials, including services categorized as AI. Our investigation started when we observed attempts from the IP address associated with the Loot and UltraVault host taking actions to validate Amazon Bedrock credentials.

We regularly observe attempts at GetCallerIdentity, ListFoundationModels, and InvokeModel using listed compromised AWS credentials. The pattern is consistent: Confirm the identity works, enumerate what the account can reach, then start calling models.

The actor triggers many InvokeModel attempts to determine whether a foundation model will process the request. We observed a burst of InvokeModel calls to multiple Anthropic model versions, repeated dozens of times across regions in under a minute. In a later evolution starting in September 2026, the attempts also targeted DeepSeek, Mistral, Kimi, and GLM-5.

A variety of user agents are tied to these attempts. However, two stand out as potential detection opportunities. One is a Boto3 client running on Kali Cloud, with kali-cloud visible in the platform string. The user agent varies in version and other metadata. The following is one example of the kali-cloud string:

Boto3/1.43.72 md/Botocore#1.43.72 md/awscrt#1.0.0.dev0 ua/2.1
os/linux#6.16.8+kali-cloud-amd64 md/arch#x86_64 lang/python#3.13.14
md/pyimpl#CPython m/E,e,Z,b cfg/retry-mode#standard Botocore/1.43.72

Another observed user agent is bare urllib, with no SDK at all:

Python-urllib/3.13

In our tracking of the attacker behavior, long-term access keys remain a classic target. But we also observed the use of temporary AWS Security Token Service (STS) credentials, identifiable by the ASIA access key ID prefix and an AssumedRole identity type.

Short-lived credentials were actively being validated by the same host tied to both dashboards.

Conclusion

The findings across the credential harvesting platforms and AWS probing activity suggest significant focus on automated access and persistence with an accessible and interactive user interface. The behavior in the UltraVault side panel aligns with Anthropic’s September 2026 threat report describing the observed automation of the attack life cycle.

We can track the platform’s attack operations through the information displayed in the frontend of the application.

It is tempting to consider all vibe coded attacks as low sophistication, but there’s significant range. Sometimes vibe coded applications are less complex and break easily, such as with the Loot credential harvesting platform’s buggy parsing and simple interactive options for the end user. But the creation of dashboards, automations, and tracking of targets shows the lower barrier to entry for spinning up full operations platforms using LLM assistance.

The range of AI-assisted attack workflows is demonstrated by the tracking of an operator whose platform is shipped as a working console with compromised credentials, 14 vulnerability LPE recommendations, one-click AWS pair validation, quick export options, and other functionality.

How Datadog can help

Datadog includes out-of-the-box security rules for monitoring suspicious behavior related to stolen AWS credentials and Amazon Bedrock abuse:

Cloud SIEM:

• AWS Bedrock model discovery probing with a long term access key
• Amazon Bedrock model catalog enumeration across multiple regions
• Amazon Bedrock activity InvokeModel multiple regions
• AWS Bedrock InvokeModel from new ASN with new model ID
• Amazon Bedrock discovery attempt by long term access key
• Impossible travel observed on IAM User access key
• Temporary AWS security credentials generated for user

The Datadog Security Research team has decided not to share indicators in order to protect the exposed credentials of many victims.

Our team’s analysis was limited to reviewing domains accessible without authentication. We did not use or validate any exposed credentials.

References

• From prompting to autonomy: the evolution of adversarial AI
• Detecting and countering misuse of AI: September 2026