Cybersecurity researchers have disclosed a mass-scanning campaign targeting Vite development servers that are reachable from the internet. The automated effort is designed to siphon sensitive cloud credentials and configuration data from exposed deployments.
Vite is widely used by developers, but when its dev server is left publicly accessible it can become a target for credential theft. The campaign appears to be broad in scope, scanning for vulnerable instances rather than focusing on a single organization.
Organizations using Vite should restrict public access to development servers, rotate any credentials that may have been exposed, and watch for signs of misuse. Locking down these services is a practical first step against this kind of automated attack.