Mass Scanning Campaign Exploits CVE-2026-39364 in Exposed Vite Servers to Harvest AWS and Azure Credentials

F5 Labs documented reconnaissance and exfiltration requests against servers with --host or server.host enabled, bypassing server.fs.deny through appended parameters like ?raw or ?import&url&inline. Requests originated from Google Cloud ranges in the US, Belgium, Netherlands, Singapore, and Taiwan, employing forged User-Agents mimicking Googlebot and GPTBot plus spoofed X-Forwarded-For headers to evade IP restrictions.

Procurement and incident patterns show repeated exposure of development tooling without network segmentation, consistent with prior campaigns against exposed Jupyter and Docker registries. The technical evidence confirms credential paths via /proc/self/cwd/.env but lacks attribution beyond infrastructure reuse; official claims of state involvement remain unverified by packet captures or malware samples.

Misconfigurations enabling the flaw—explicit network binding plus mismatched allow/deny lists—mirror supply-chain risks in CI/CD pipelines where cloud credentials reside in plaintext. Attackers demonstrate operational knowledge by probing process-relative paths rather than guessing absolute locations.

Expect expanded scans against similar Node.js dev servers within 60 days, with F5-tracked indicators shifting to new GCP and Azure egress ranges as operators rotate infrastructure.