Hackers Mass-Scan Exposed Vite Servers to Steal AWS and Azure Cloud Credentials

Hackers are conducting a large-scale automated scanning campaign against internet-exposed Vite development servers, attempting to steal AWS credentials, Azure access tokens, environment variables, and Infrastructure-as-Code secrets.

F5 honeypot sensors recorded 807 session-grouped attacks and about 32,000 raw events in August 2026, a sharp increase from only 1,732 Vite-related file-read events observed over the previous three months.

The operation primarily exploited CVE-2026-39364, a high-severity Vite file-disclosure vulnerability published in April 2026. Attackers also tested older Vite access-control bypasses, suggesting the scanning infrastructure uses a broad exploit library rather than relying on a single vulnerability.

The rapid jump in activity demonstrates how quickly threat actors incorporate newly disclosed framework flaws into automated cloud credential-harvesting campaigns.

Vite Server Cloud Credentials

CVE-2026-39364 affects Vite 7.1.0 through 7.3.1 and Vite 8.0.0 through 8.0.4. The vulnerability lets unauthenticated attackers retrieve files that the server.fs.deny configuration should block, including .env files and certificates.

Vite provides an internal @fs route that serves files from the host filesystem during development. Although the deny-list mechanism is intended to prevent browsers from requesting sensitive content, specially constructed query parameters including ?raw, ?import&raw, and ?import&url&inline can bypass that protection and cause the server to return restricted files with an HTTP 200 response.

Exploitation requires the Vite development server to be reachable over a network, the targeted file to reside within a directory permitted by server.fs.allow, and the file to match a server.fs.deny rule.

Vite binds to localhost by default, but developers can expose it to LAN or public interfaces through the –host option, server.host configuration, container port mappings, Kubernetes ingress rules, or cloud security-group mistakes.

F5 observed requests that combined the @fs endpoint with query-string bypasses, path traversal, and double-encoded separators. Examples included requests for .env, /root/.env, /proc/self/environ, and deeply encoded paths containing %252f.

Double encoding can help malicious requests pass through reverse proxies or web application firewalls that normalize paths differently from the backend server.

The scanners used a carefully assembled credential wordlist covering .env.local, .env.production, .env.staging, AWS credential files under common Linux user directories, AWS SSO caches, backup keys, rootkey.csv, aws-exports.js, and Amplify configuration files.

They also searched for Azure accessTokens.json and credential files, along with Terraform state, Terraform variables, Serverless Framework state, and other deployment artifacts.

Particularly notable was probing for /proc/self/cwd/.env, which can reveal the active application’s environment file without requiring an attacker to know its absolute installation path.

A successful response could expose API keys, database passwords, cloud access keys, session secrets, infrastructure addresses, and Terraform-managed resource data, potentially turning a development-server disclosure into broader cloud compromise.

The campaign sent HTTP/1.0 requests with Connection: close, a pattern consistent with lightweight automated scanners.

Requests rotated forged User-Agent strings impersonating Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot, while fabricated X-Forwarded-For and X-Real-IP headers attempted to confuse log analysis or evade poorly implemented IP allowlists.

Most activity originated from cloud-hosting infrastructure, particularly addresses in Google Cloud Platform’s 34.x and 35.x ranges.

The United States accounted for 17,297 recorded events, followed by Belgium with 4,407, the Netherlands with 4,011, Singapore with 2,842, Taiwan with 1,994, and Japan with 1,353.

A subset of the same infrastructure also probed CVE-2025-29927, a Next.js middleware authorization bypass, suggesting the operators scan multiple web-development frameworks simultaneously.

The Vite traffic also triggered signatures for CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811, all involving related file-access bypass techniques.

CISA added CVE-2025-31125 to its Known Exploited Vulnerabilities catalog in January 2026, reinforcing that exposed Vite development services are already being targeted in real-world activity.

Organizations should upgrade affected installations to Vite 7.3.2, 8.0.5, or newer supported releases and remove development servers from public-facing networks.

Security teams should audit Docker Compose files, Kubernetes services, ingress configurations, reverse proxies, firewall rules, and cloud security groups for exposed development ports, particularly Vite’s commonly used port 5173.

Defenders should also inspect HTTP logs for requests containing /@fs/, suspicious raw or import query parameters, encoded traversal sequences, and attempts to retrieve environment, AWS, Azure, Terraform, or /proc files.

Do not trust bot identities solely from User-Agent strings; validate crawler access with appropriate IP and reverse-DNS verification. Any organization that exposed an unpatched Vite server should assume attackers may have collected accessible secrets.

AWS keys, Azure tokens, database credentials, API secrets, signing keys, and Terraform-managed credentials should be revoked or rotated, followed by a review of cloud audit logs for unauthorized authentication, privilege escalation, persistence, and resource creation.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.