cyber.hendryadrian.com
Threat Research · trendmicro.com

Vercel Breach Traced to Stolen OAuth Tokens, Exposing Environment Variables in Compromised Teams

· Original article ↗

Summary

A Lumma Stealer infection at Context.ai led attackers to use stolen OAuth tokens to access Vercel systems and enumerate environment variables in a limited subset of customer projects. The article details the attack chain, risks and defensive steps.

Key points

  • The reported intrusion began with a Lumma Stealer infection at Context.ai in February 2026; stolen OAuth tokens were later used to access a Vercel employee’s Google Workspace account and pivot into Vercel systems.
  • Vercel said the attacker accessed environment variables for a limited subset of customer projects, not customer secrets platform-wide.
  • Variables not marked sensitive could be readable within compromised team scopes; Vercel rolled out dashboard changes, while the article says sensitive status still required per-variable opt-in.
  • A customer reported receiving an OpenAI leaked-key notification on April 10, before Vercel’s April 19 disclosure. The article notes this is a single public report, not proof Vercel knew of the breach then.
  • Claims of Vercel data for sale and ShinyHunters involvement remain unverified; Vercel said its review found Next.js, Turbopack and its open-source projects safe.
  • The article recommends auditing OAuth grants, rotating potentially exposed credentials, redeploying affected environments, and checking downstream service logs for suspicious use.

Article Details

Attack Vectors
  • According to Hudson Rock, CyberScoop, and Context.ai reporting cited in the article, a Context.ai employee was infected with Lumma Stealer around February 2026, reportedly after downloading Roblox game exploit scripts. Corporate credentials, session tokens, and OAuth tokens were stolen.
  • Stolen credentials enabled access to Context.ai's AWS environment around March 2026, where attackers exfiltrated consumer OAuth tokens, including a Vercel employee's Google Workspace token.
  • The compromised OAuth token enabled access to the employee's Google Workspace account and a subsequent pivot into Vercel internal systems. The precise internal lateral-movement mechanism has not been disclosed.
  • Attackers enumerated readable, non-sensitive environment variables within directly compromised Vercel team scopes. The reported impact was limited to an undisclosed subset of customer projects, not platform-wide access to customer secrets.
  • Exposed environment variables could enable downstream service access. A single customer reported an OpenAI leaked-key notification before Vercel's disclosure, but this does not establish the extent of downstream exploitation or when Vercel became aware.
  • The article also describes malicious LiteLLM package releases using stolen publishing credentials, malicious axios releases following maintainer account compromise, and historical platform breaches involving stolen credentials or session tokens.
Defensive Notes
  • Rotate credentials stored in Vercel environment variables that were not marked sensitive, and enable the sensitive flag for all credentials, tokens, keys, and secrets.
  • Redeploy every environment after credential rotation or explicitly disable old deployments; the article states that existing deployments retain their previous environment-variable values.
  • Search Google Workspace OAuth logs for the compromised Context.ai application client ID. Revoke matching authorization and investigate any associated activity.
  • Review third-party OAuth grants for broad permissions, inactive vendor relationships, and unexpected source IP addresses. Revoke unused grants and periodically reassess authorized applications.
  • Review Vercel audit logs for unusual environment-variable reads or listings, especially high-volume access, unexpected identities, and access outside normal deployment activity.
  • Investigate downstream service logs for use of exposed credentials from unexpected IP addresses, user agents, or time windows, covering February 2026 onward.
  • Treat unsolicited leaked-credential notifications as high-priority investigation signals. The reported April 10 notification is a single customer account, not proof that Vercel knew about the breach then.
  • Use dedicated secrets managers with runtime injection, temporary role-based credentials, least-privilege permissions, and OIDC-based pipeline authentication where supported.
  • Preserve sufficient OAuth audit-log history; the article notes that many Google Workspace subscription tiers retain these logs for six months by default.
  • Monitor checksums, signing, and provenance for Next.js and Turbopack releases. Vercel stated that its open-source release paths remained safe, while independent verification was still ongoing.
  • Do not treat ShinyHunters-affiliated forum claims or the CEO's suspected AI acceleration as confirmed forensic findings.
  • The article gives inconsistent descriptions of encryption at rest. Its supported operational concern is that non-sensitive variables were readable within compromised team scopes.

Indicators of compromise

TypeIndicatorContext
HOSTNAME110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj[.]apps[.]googleusercontent[.]comKnown-bad OAuth client ID identifying the compromised Context.ai application used in the Vercel attack chain; the article recommends alerting on associated authorization or token-refresh events.

MITRE ATT&CK

T1078 · Valid AccountsStolen Context.ai credentials enabled access to its AWS environment, and the compromised Vercel employee identity was subsequently used to reach Vercel internal systems.T1078.004 · Cloud AccountsIn the historical Snowflake attacks, UNC5537 used infostealer-obtained credentials to access customer cloud accounts that lacked MFA.T1195.002 · Compromise Software Supply ChainThe article describes malicious LiteLLM and axios package releases and the historical modification of Codecov's Bash Uploader to steal customer environment variables.T1199 · Trusted RelationshipAttackers abused Vercel employees' existing trust relationship with the compromised Context.ai OAuth application to reach a Vercel employee's Google Workspace account.T1539 · Steal Web Session CookieIn the historical CircleCI incident described by the article, malware on an employee's personal device stole an SSO session token.T1550.001 · Application Access TokenAn exfiltrated Google Workspace OAuth token was used to access a Vercel employee's account without requiring the employee's password.T1550.004 · Web Session CookieThe historical CircleCI attacker used the stolen employee SSO session token to access internal systems and exfiltrate customer secrets and encryption keys.T1552 · Unsecured CredentialsAttackers obtained credentials by enumerating readable, non-sensitive customer environment variables within compromised Vercel team scopes.

CVE

CVE-2026-33634CVE involved: CVE-2026-33634.

People

Andrey ZagoruikoVercel customer who reported receiving an OpenAI leaked-key notification on April 10, 2026, for a key he said existed only in Vercel; the article treats this as a single public report rather than a forensic finding.Guillermo RauchVercel CEO who publicly confirmed the attack chain, identified Context.ai as the compromised third party, described customer impact as limited, and expressed an unverified suspicion that AI accelerated the attackers.

Threat Actors

Sapphire SleetMicrosoft attributed the axios npm supply-chain compromise to this actor, described in the article as North Korean state-sponsored.ShinyHuntersAn unnamed forum poster claimed affiliation with this group while alleging possession of Vercel data. The claims remain unverified, and known members reportedly denied involvement to BleepingComputer.TeamPCPThe article identifies this tracked actor as compromising Trivy CI/CD credentials used to publish malicious LiteLLM packages.UNC5537The article identifies this actor as using infostealer-obtained credentials to access Snowflake customer accounts lacking MFA in May–June 2024.

Malware

Lumma Stealerthe initial compromise occurred in February 2026 (not June 2024), the initial access vector was Lumma Stealer malware (not an unknown mechanism), the dwell time was approximately two months (not 22 months), and

Vendors

Amazon Web ServicesAttacker accesses Context.ai’s AWS environment; exfiltrates OAuth tokens for consumer users including a Vercel employee’s Google Workspace tokenAqua Securityversions 1.82.7 and 1.82.8 were published using stolen CI/CD publishing credentials from Trivy (Aqua Security's vulnerability scanner). The attack targeted LiteLLM, a widely-used LLM proxy with ~3.4 million dailyCircleCIcontextualizes the breach against a rising wave of supply chain compromises (LiteLLM, Axios, Codecov, CircleCI), and provides actionable detection and hardening guidance for organizations operating on Vercel andCodecovradius, contextualizes the breach against a rising wave of supply chain compromises (LiteLLM, Axios, Codecov, CircleCI), and provides actionable detection and hardening guidance for organizations operating onContext.aiThis entry was updated on April 21 to correct the incident timeline and scope characterization based on post-publication reporting from Context.ai's security bulletin.OktaOkta support system breach (October 2023)OpenAIOpenAI notifies a Vercel customer of a leaked API key (per customer account on X)SnowflakeSnowflake customer credential attacks (May–June 2024)VercelThis analysis reflects what is publicly known about the Vercel OAuth supply chain compromise as of the date above. The incident remains under active investigation by Vercel and affected parties, and key details —

Products

AWS Secrets ManagerThe industry trend is toward purpose-built secret storage, such as Vault, AWS Secrets Manager, Doppler, and Infisical, rather than environment variable stores with sensitivity tiers. This breach validates thatAxiosblast radius, contextualizes the breach against a rising wave of supply chain compromises (LiteLLM, Axios, Codecov, CircleCI), and provides actionable detection and hardening guidance for organizations operatingCircleCIcontextualizes the breach against a rising wave of supply chain compromises (LiteLLM, Axios, Codecov, CircleCI), and provides actionable detection and hardening guidance for organizations operating on Vercel andCodecov's Bash UploaderWhat happened: Attackers modified Codecov's Bash Uploader script (used in CI/CD pipelines) to exfiltrate environment variables from customers' CI environments. The compromise went undetected for approximately twoContext AI Office Suiteto access Context.ai’s AWS environment and exfiltrate OAuth tokens for consumer users of Context AI Office Suite, a self-serve consumer product launched in June 2025.DopplerThe industry trend is toward purpose-built secret storage, such as Vault, AWS Secrets Manager, Doppler, and Infisical, rather than environment variable stores with sensitivity tiers. This breach validates thatGoogle WorkspaceFebruary 2026 and was disclosed in April 2026, attackers leveraged a compromise of Context.ai’s Google Workspace OAuth tokens to gain a foothold into Vercel’s internal systems, exposing environment variables forHashiCorp VaultHashiCorp VaultInfisicalindustry trend is toward purpose-built secret storage, such as Vault, AWS Secrets Manager, Doppler, and Infisical, rather than environment variable stores with sensitivity tiers. This breach validates thatLiteLLMamplified blast radius, contextualizes the breach against a rising wave of supply chain compromises (LiteLLM, Axios, Codecov, CircleCI), and provides actionable detection and hardening guidance for organizationsMicrosoft EntraAudit OAuth application authorizations in your Google Workspace (or Microsoft Entra) admin console. Revoke access for any application that is no longer actively used.Next.jsRauch directly addressed the highest-impact scenario stating that “We've analyzed our supply chain, ensuring Next.js, Turbopack, and our many open source projects remain safe for our community.” OktaOkta support system breach (October 2023)SnowflakeSnowflake customer credential attacks (May–June 2024)TurbopackRauch directly addressed the highest-impact scenario stating that “We've analyzed our supply chain, ensuring Next.js, Turbopack, and our many open source projects remain safe for our community.” VercelThis analysis reflects what is publicly known about the Vercel OAuth supply chain compromise as of the date above. The incident remains under active investigation by Vercel and affected parties, and key details —

Tools

Trivypackages litellm versions 1.82.7 and 1.82.8 were published using stolen CI/CD publishing credentials from Trivy (Aqua Security's vulnerability scanner). The attack targeted LiteLLM, a widely-used LLM proxy with ~3.4

Countries

North Korea

Industries

SoftwareThis is the multiplier that elevates a platform breach from a confidentiality event into a potential cascade across the software supply chain.

Related Articles