Cybersecurity researchers have uncovered a mass-scanning campaign targeting Vite development servers to steal sensitive data. This automated attack aims at internet-exposed Vite servers, with the goal of extracting cloud credentials and configuration files from Amazon Web Services and Microsoft Azure. The campaign exploits CVE-2026-39364, a high-severity vulnerability in Vite that allows unauthenticated attackers to bypass security restrictions by manipulating query parameters, enabling them to access sensitive files such as those specified by server.fs.deny.

The flaw was highlighted in an advisory issued by Vite in April 2026, stating that files normally blocked by server.fs.deny can be accessed when certain query parameters are added to HTTP requests. For successful exploitation, certain conditions must be met, such as the service being exposed due to misconfigurations like using the --host flag or incorrect Docker port mappings. Once these conditions are met, attackers can send HTTP GET requests to specific endpoints, retrieving sensitive data like API secrets and cloud credentials in plaintext.

The campaign uses sophisticated methods to evade detection, including bogus User-Agent headers imitating well-known web crawlers and AI bots, as well as forged IP values to bypass access lists. The bulk of the malicious activity has been traced back to countries like the U.S., Belgium, the Netherlands, Singapore, and Taiwan, with attackers leveraging Google Cloud Platform IP ranges to mask their activities. This attack poses significant risks by potentially granting unauthorized access to critical infrastructure components.