Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms

Datadog researchers observed two exposed credential-harvesting dashboards, “Loot” and “UltraVault,” that catalog, validate, and facilitate offensive actions with stolen secrets (including AI and cloud API keys). UltraVault offers one-click validation, exploit chains tied to known CVEs, LPE recommendations, and post‑exploitation tooling (minted credentials, web shell management), while both platforms actively re‑probe compromised credentials and have been used to abuse Amazon Bedrock APIs.