Hackers Target Exposed Vite Dev Servers to Steal AWS and Azure Secrets

A mass-scanning campaign is targeting internet-exposed Vite development servers to steal AWS and Azure cloud credentials and configurations. According to reports, threat actors are probing these servers, which are inadvertently made public, to harvest sensitive cloud information. The campaign leverages mass-scanning techniques to identify Vite development servers accessible from the internet. Once identified, these servers are targeted to extract AWS and Azure credentials and configurations. The exact exploitation method and the full scope of data exfiltration remain unverified. The findings highlight the risk of inadvertently exposing development tools to the public internet. Vite, a popular front-end build tool, is being targeted not for a specific vulnerability, but for its misconfiguration and public exposure. The campaign underscores the need for developers to restrict access to development servers and rotate any credentials that may have been compromised. As of now, no specific patch or mitigation from the Vite maintainers has been reported, and the focus is on operational security measures such as network segmentation and credential rotation.