Threat actors are running an active mass-scanning campaign against internet-exposed Vite development servers to harvest cloud credentials and infrastructure files from AWS and Azure environments.
F5 Labs identified the operation targeting Vite, a popular JavaScript build tool and development server framework used by thousands of development teams worldwide. The attackers exploit misconfigured or accidentally exposed Vite instances to extract sensitive data including AWS access keys, Azure credentials, and Terraform state files that contain infrastructure topology and secrets.
Vite gained adoption rapidly among frontend developers for its speed and modern tooling. The tool runs locally during development to serve code with hot module replacement and rapid feedback loops. When developers accidentally expose these servers to the internet rather than running them on localhost, they create an attack surface. The Vite development mode typically serves source code, configuration files, and environment variables that should never touch public networks.
The mass-scanning approach indicates attackers use automated reconnaissance tools to identify internet-exposed Vite instances. Once located, they likely request common paths and configuration directories where credentials appear. AWS credentials stored in environment variables or configuration files become immediately valuable. Azure credentials and service principals grant access to cloud resources. Terraform state files prove especially damaging because they document entire infrastructure deployments, database passwords, API keys, and resource IDs.
The risk extends beyond the development team. Compromised AWS or Azure credentials grant attackers persistent access to production environments, databases, storage accounts, and compute resources. A single exposed development server can lead to wholesale cloud infrastructure compromise. Teams running multiple services across AWS and Azure face multiplicative exposure. The attacker gains the ability to steal data, deploy ransomware, establish persistent backdoors, or modify production systems undetected.
This campaign reflects a broader trend in cloud security. Development and testing infrastructure historically received less scrutiny than production systems. Teams prioritize deployment speed over hardening temporary environments. Developers testing locally often disable security restrictions to move faster. When these instances accidentally reach the internet, they become low-hanging fruit for opportunistic attackers running continuous reconnaissance scanners.
Organizations using Vite should immediately audit which instances run on internet-accessible networks. Development servers should bind only to 127.0.0.1 or ::1, preventing external access entirely. If development requires remote access, teams should place instances behind VPN or identity-aware proxy solutions rather than exposing them directly. Cloud credentials should never appear in environment variables or checked into version control alongside Vite configurations. Teams should use AWS IAM roles and Azure managed identities instead, with credentials retrieved from secure backends at runtime.
Environment-specific configuration files deserve particular attention. .env files and similar configuration stores frequently contain credentials developers entered during setup. These files should never deploy to production or exposed environments. Development teams should rotate any credentials that appear in exposed Vite instances immediately. AWS and Azure both provide tools to track credential usage and identify suspicious access patterns after compromise occurs.
This campaign will likely persist as long as development servers remain exposed online. Attackers operate with minimal cost against a vast target surface of misconfigured deployments. Even if a small percentage of Vite deployments remain exposed, the volume produces valuable targets for automated reconnaissance operations.