Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms

What it is

Datadog Security Research has tracked two vibe-coded credential harvesting dashboards, Loot and UltraVault, since July 2026. Both were served at times from one host and were reachable without authentication. The same host's IP was seen validating stolen AWS credentials against Amazon Bedrock. Datadog did not share indicators, to protect victims whose credentials are exposed, and did not use or validate any exposed credentials.

How it works

Loot is a plaintext credential catalog with search by victim domain or type and a validate button. Parsing is poor and many entries are misclassified, but many are genuine. Its AI category holds 1,778 records, 196 live. The largest provider counts are OpenAI (699, 93 live), Gemini (666, 55 live) and Anthropic (114, 10 live).

UltraVault adds validation through /api/credentials/validate and /api/credentials/validate_category, which return live, dead, pending or unchecked. It groups targets under five exploitation chains:

• react2shell (CVE-2025-55182)
• wp2shell (CVE-2026-63030 and CVE-2026-60137)
• xss2shell (CVE-2026-64638)
• joomla2shell (CVE-2026-48907)
• deep

For AWS, /api/pairs joins access keys and secret keys that were collected separately. /api/actions/aws_pair submits a reconstructed pair and shows the account ID, ARN and region. A side panel walks 14 local privilege escalation checks and gives go or no-go verdicts plus one recommended exploit. One-click actions include wp_reshell, wp_rexploit and xss_admin, and rsc_escalate requests cloud and internal reconnaissance from a compromised Node process.

The operator's inventory claims 42,286 secrets, of which about 2.7% are live.

What to do

Bedrock abuse followed a fixed order: GetCallerIdentity, then ListFoundationModels, then InvokeModel. Hunt for these in CloudTrail:

• Bursts of InvokeModel across several Anthropic model versions and regions, dozens of times in under a minute. From September 2026 the calls also hit DeepSeek, Mistral, Kimi and GLM-5.
• A Boto3 user agent with kali-cloud in the platform string, for example os/linux#6.16.8+kali-cloud-amd64. Version and other fields vary, so match on the substring.
• The bare user agent Python-urllib/3.13, with no SDK.
• Validation of temporary STS credentials (ASIA key prefix, AssumedRole identity), not only long-term keys.

Datadog lists out-of-the-box Cloud SIEM rules for stolen AWS credentials and Bedrock abuse. The fetched text does not name them.

Caveats

• Datadog could not confirm that the react2shell cloud pivot reached metadata, Kubernetes or cloud credentials. The evidence is frontend code only.
• Roughly a third of the 17 reviewed capabilities are visible directly in frontend source. The rest rely on UI action requests or backend-reported results.
• Loot does not show how its credentials were obtained.
• Every LPE bug in the matrix requires prior access to the host.