Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
Malware Families
Excerpt
Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms | Datadog Security Labs Security Labs ARTICLES CLOUD SECURITY ATLAS NEWSLETTER ABOUT ARTICLES CLOUD SECURITY ATLAS NEWSLETTER ABOUT research Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms September 18, 2026 threat research aws twitter reddit on this page Key points and observations The Loot dashboard The UltraVault dashboard…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2025-55182 | High | Score 82/100 | First seen |
| CVE | CVE-2026-64638 | Medium | Score 57/100 | First seen |
| CVE | CVE-2026-63030 | High | Score 78/100 | First seen |
| CVE | CVE-2026-48907 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-60137 | High | Score 74/100 | First seen |
IOC Relationship Graph
Building graph…