Hackers are conducting a large-scale automated scanning campaign against internet-exposed Vite development servers, targeting AWS credentials, Azure access tokens, environment variables, and Infrastructure-as-Code secrets This article explores restricted files http. . F5 honeypot sensors recorded 807 session-grouped attacks and about 32,000 raw events in August 2026, marking a significant increase from only 1,732 Vite-related file-read events observed over the previous three months.
Although the deny-list mechanism is intended to prevent browsers from requesting sensitive content, specially crafted query parameters, such as ?raw, ?import&raw, and ?import&url&inline, can bypass this protection and cause the server to return restricted files with an HTTP 200 response.
Attack activity trends (Image Source: F5) Vite defaults to binding to localhost, but developers can expose it to LAN or public interfaces via the –host option, server.host configuration, container port mappings, Kubernetes ingress rules, or cloud security-group mistakes. Scanners utilized a meticulously crafted credential wordlist encompassing .env.local, .env.production, .env.staging, AWS credential files within common Linux user directories, AWS SSO caches, backup keys, rootkey.csv, and Amplify configuration files. Requests rotated forged User-Agent strings impersonating Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot, while fabricated X-Forwarded-For and X-Real-IP headers attempted to confuse log analysis or evade poorly implemented IP allowlists.
The United States reported 17,297 incidents, followed closely by Belgium with 4,407, the Netherlands with 4,011, Singapore with 2,842, Taiwan with 1,994, and Japan with 1,353.
