Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
Datadog exposes Loot and UltraVault, AI-assisted credential-harvesting platforms that abuse Amazon Bedrock to validate stolen secrets—a sign that phishing infrastructure is industrialising rapidly.
Summary written by editorial AI · Source link below
In this post, we examine two vibe-coded credential harvesting platforms, Loot and UltraVault, and the Amazon Bedrock abuse used to validate stolen secrets.
Editorial Analysis
The integration of cloud AI services into phishing infrastructure accelerates credential exploitation, compressing the window between theft and account compromise.
Deploy phishing-resistant MFA enterprise-wide and monitor for anomalous cloud AI API usage that may signal credential-validation abuse.
Attackers are using cloud AI services to industrialise credential theft—phishing-resistant authentication is now a baseline, not a differentiator.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Datadog Security Labs in a new tab.
More from the Threat Intel Desk
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking1d
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot2d
- Trust Is Not What It Seems — And Fraudsters Are Counting on It3d
- AI Tools Are Generating Massive Attacks for Little Cost3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)3d