As cited
Copy frozen at (site build).
threat intel
Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
Two credential harvesting platforms, Loot and UltraVault, are examined for their operational characteristics and methods. The analysis reveals how attackers use Amazon Bedrock to validate stolen secrets, demonstrating a technical evolution in how harvested credentials are processed and verified.
Why it matters: Security teams managing credential exposure monitoring and cloud service abuse detection need to understand these platforms and the use of legitimate services like Amazon Bedrock in post-compromise validation workflows.
- Source published
- First seen by Cybersecurity Tracker