Vercel breach linked to Context.ai device infected after Roblox exploit search
Summary
Hudson Rock linked the Vercel breach to a Context.ai employee’s device infected with Lumma Stealer. Vercel said an attacker used OAuth access to reach environments and variables; a group claiming to be ShinyHunters says it is selling data.
Key points
- Hudson Rock researchers said a Context.ai employee’s device was infected with Lumma Stealer after the employee searched for Roblox game exploits.
- Context.ai said the breach exposed its AWS environment and some users’ OAuth tokens, including one for a Vercel employee’s Google Workspace account.
- Vercel said the attacker took over that account and accessed some Vercel environments and environment variables that were not marked sensitive.
- Vercel said a limited number of customers were affected and advised them to rotate credentials; it also urged customers to review logs and rotate variables containing secrets.
- A group identifying itself as ShinyHunters claimed responsibility and said it was selling access keys, source code and databases. Google Threat Intelligence’s Austin Larsen said the group could be an imposter.
- Vercel and Context.ai investigations, with assistance from CrowdStrike and Mandiant, were ongoing.
Article Details
- Victim Organization
- Vercel
- Incident Type
- Third-party compromise involving Lumma Stealer infection, stolen credentials and OAuth tokens, and unauthorized access to Vercel environments.
- Data Types Exposed
- Credentials and OAuth tokens
- Environment variables, including some not marked as sensitive
- Access keys, source code, and databases (claimed by the group identifying itself as ShinyHunters to be among the stolen data; the claim is unverified)
- Affected Records
- A limited number of Vercel customers were reportedly impacted; the exact number was not disclosed.
- Affected Data Size
- Not disclosed
- Operational Impact
- The attacker accessed some Vercel environments and environment variables. Vercel advised affected customers to rotate credentials and review logs. Investigations were ongoing.
- Ransom Or Extortion
- A group identifying itself as ShinyHunters claimed responsibility and attempted to sell the data it said was stolen. Google Threat Intelligence analyst Austin Larsen said the group was likely an imposter; the sale and the group's attribution are unverified.
- Claim Status
- confirmed
MITRE ATT&CK
People
Threat Actors
Malware
Vendors
Context.aiAn attacker moved through third-party systems to steal credentials and sensitive data from Vercel after compromising a Context.ai employee’s machine with Lumma Stealer.CrowdStrikeVercel and Context.ai say a limited number of customers were affected, investigators including CrowdStrike and Mandiant are involved, and a group claiming to be ShinyHunters is attempting to sell the stolen data.GoogleAttackers used stolen OAuth tokens to take over a Vercel employee’s Google Workspace account and access environment variables.MandiantVercel and Context.ai say a limited number of customers were affected, investigators including CrowdStrike and Mandiant are involved, and a group claiming to be ShinyHunters is attempting to sell the stolen data.VercelAn attacker moved through third-party systems to steal credentials and sensitive data from Vercel after compromising a Context.ai employee’s machine with Lumma Stealer.
Products
Context AI Office SuiteVercel is not a Context customer, but the Vercel employee was using Context AI Office Suite and granted it full access, the artificial intelligence agent company said.Google WorkspaceAttackers used stolen OAuth tokens to take over a Vercel employee’s Google Workspace account and access environment variables.