The attackers appear to be opportunistically scanning for publicly reachable dev servers and attempting to extract secrets that grant access to cloud infrastructure.

If you run Vite in development mode on a host that is reachable from the internet, you should assume it is a target and review your exposure immediately.

Key points to keep in mind:

• Vite dev servers are the focus of the scanning activity
• The campaign attempts to harvest AWS and Azure credentials and configuration data
• Internet-exposed development servers are the primary attack surface

Recommended actions:

• Avoid exposing Vite dev servers directly to the internet
• Bind dev servers to localhost or a trusted internal interface where possible
• Restrict access with firewall rules or a VPN if remote access is required
• Rotate any cloud credentials that may have been present on an exposed dev host
• Review cloud logs for unexpected access from unfamiliar sources

Source: BleepingComputer

Has anyone in the community found exposed Vite dev servers in their own environments, and how are you handling access controls for development instances?