Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms | Datadog Security Labs

MITRE Techniques

• [T1082 ] System Information Discovery – The platform queried cloud and host details to understand what the compromised environment could access (‘Confirm the identity works, enumerate what the account can reach, then start calling models.’).
• [T1580 ] Cloud Infrastructure Discovery – The operator checked AWS and cloud reachability, including account and region details, before further actions (‘GetCallerIdentity, ListFoundationModels, ListInferenceProfiles’).
• [T1528 ] Steal Application Access Token – The dashboards stored and displayed API tokens and minted credentials for later use (‘It lists relevant API tokens and minted credentials’).
• [T1110 ] Brute Force – Credential Stuffing – The system repeatedly re-validated stolen secrets and tested credentials across categories (‘re-probe keys they have already stolen’, ‘validate_category’).
• [T1059 ] Command and Scripting Interpreter – Backend actions and one-click operations were used to drive exploitation and validation workflows (‘dispatch of commands to web shells via its backend’).
• [T1190 ] Exploit Public-Facing Application – The exploitation chains referenced WordPress, Joomla, XSS, and React-to-shell paths used to gain code execution (‘react2shell’, ‘wp2shell’, ‘xss2shell’, ‘joomla2shell’).
• [T1068 ] Exploitation for Privilege Escalation – The LPE matrix recommended local privilege escalation vulnerabilities to expand access (‘walks through 14 LPE vulnerabilities and produces a final recommendation’).
• [T1021 ] Remote Services – The panel supported one-click actions against services such as cPanel on port 2083 and WordPress targets (‘attack targets port 2083, associated with cPanel’).
• [T1105 ] Ingress Tool Transfer – The platform enabled persistence and operational actions by copying, minting, and exporting credentials (‘copy credentials the attacker minted on the host’, ‘Easy export functionality’).
• [T1649 ] Steal or Forge Authentication Certificates – The system reconstructed AWS access-key/secret-key pairs from separate dumps for account validation (‘correlating and validating AWS secrets’, ‘/api/pairs’).
• [T1526 ] Cloud Service Discovery – The attacker enumerated available foundation models and inference profiles in AWS Bedrock (‘ListFoundationModels’, ‘ListInferenceProfiles’).
• [T1552.001 ] Credentials In Files – The dashboards aggregated secrets collected from dumps and displayed them in plaintext (‘category-navigable index of credentials, all displayed in plaintext’).