Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
Datadog exposes Loot and UltraVault, AI-assisted credential-harvesting platforms that abuse Amazon Bedrock to validate stolen secrets—a sign that phishing infrastructure is industrialising rapidly.
Summary written by editorial AI · Source link below
In this post, we examine two vibe-coded credential harvesting platforms, Loot and UltraVault, and the Amazon Bedrock abuse used to validate stolen secrets.
Editorial Analysis
The integration of cloud AI services into phishing infrastructure accelerates credential exploitation, compressing the window between theft and account compromise.
Deploy phishing-resistant MFA enterprise-wide and monitor for anomalous cloud AI API usage that may signal credential-validation abuse.
Attackers are using cloud AI services to industrialise credential theft—phishing-resistant authentication is now a baseline, not a differentiator.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Datadog Security Labs in a new tab.
More from the Threat Intel Desk
- Hackers pull off $133 million French bank heist via service provider2d
- Fake security tools on GitHub push backdoors and infostealers3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026)3d
- CEO-spoofing scammers used AI to help steal more than $100 million, feds say3d
- Chainalysis says breach exposed credentials for all customers3d