Hackers Are Mass-Scanning Vite Servers to Steal AWS and Azure Credentials

Hackers are mass-scanning internet-exposed Vite development servers to steal AWS and Azure credentials, environment files, and other sensitive configuration data.

Attackers are exploiting CVE-2026-39364, a high-severity file access vulnerability affecting Vite 7.1.0 through 7.3.2 and Vite 8.x versions before 8.0.5.

The flaw allows unauthenticated attackers to bypass Vite’s file access restrictions and retrieve files that should not be publicly accessible.

Technology company F5 detected more than 800 attacks and roughly 32,000 raw events during one month through its honeypot infrastructure.

Hackers are searching for AWS and Azure credentials

After identifying a vulnerable Vite server, attackers attempt to access sensitive files containing:

• AWS credentials and configuration files
• Azure credentials and access tokens
• Environment (.env) files
• Terraform state and variable files
• Serverless configuration and state files
• Process environment data
• Other application and system configuration files

Access to these files could allow attackers to move beyond the exposed development server and compromise connected cloud infrastructure.

Attackers have also tested path traversal and encoding techniques that could help requests bypass reverse proxies and web application firewalls.

Several Vite vulnerabilities are being targeted

The scanning infrastructure has also attempted to exploit several older Vite access-control vulnerabilities, including CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811.

Developers can accidentally expose Vite development servers through host configuration changes or incorrectly configured Docker port mappings.

This creates additional risk because development environments can contain environment variables, cloud credentials, and configuration files that production applications normally keep inaccessible.

Developers should update Vite and restrict public access

F5 recommends updating Vite to the latest available version and ensuring development servers are not accessible from the public internet.

Administrators should also make sure port 5173 isn’t publicly exposed and monitor suspicious requests targeting Vite’s filesystem functionality.

F5 warns administrators not to rely on crawler User-Agent strings as a security control because attackers can easily change them.

Organizations that previously exposed an unpatched Vite server should treat accessible secrets as potentially compromised and rotate credentials and tokens reachable from the affected environment.

In other security news, ENISA warns that AI can exploit vulnerabilities in minutes, while attackers are also hijacking Microsoft 365 accounts through fake passkey alerts.

Separately, the BlueMoon exploit kit can escape Chrome and elevate Windows privileges, highlighting another active threat targeting Windows users.

Via BleepingComputer