# Context.ai OAuth Token Compromise: SaaS Integration-Layer Supply Chain Attack

> Attackers stole OAuth refresh tokens issued to Context.ai, a SaaS data-ingestion platform, and abused the trust relationships to pivot into downstream customer tenants via connected Salesforce, HubSpot, Slack, and Google Workspace integrations. No Context.ai code was modified; the compromise lives entirely at the integration layer, giving the actor read/write access to every tenant that had granted Context.ai OAuth scopes. Wiz researchers disclosed the incident on 2026-04-20 after observing mass-scale data exfiltration from dozens of victim tenants.

- **Published:** 2026-04-20T12:00:00Z
- **Last reviewed:** 2026-04-20T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0398
- **ID:** TL-2026-0398
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** UNC6438
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-04-19, Wiz Threat Research identified anomalous API traffic originating from Context.ai infrastructure ranges against multiple unrelated Salesforce and Google Workspace customer tenants. Investigation determined that on or about 2026-04-08 an unknown actor obtained access to Context.ai's production secrets management system (HashiCorp Vault) via a compromised GitHub Actions workflow that logged a long-lived personal access token to a public build artifact. The actor used the Vault access to enumerate and exfiltrate the OAuth refresh tokens Context.ai had accumulated for every customer-granted integration, approximately 3,400 active refresh tokens covering Salesforce (T1199), HubSpot, Slack, Google Workspace, Microsoft 365, Notion, Zendesk, and GitHub.

For ~11 days the actor used these tokens from a rotating pool of residential proxy IPs (NSOCKS, 911 S5 successor) and datacenter ranges in Hetzner, OVH, and DigitalOcean to issue legitimate-looking API calls against each downstream tenant. Because the tokens were valid and scoped as the tenant had originally authorized (typical scopes: read:all-contacts, read:all-deals, read:drive.readonly, channels:history, files:read), the traffic passed authentication and logged as Context.ai activity in each tenant's audit log — there was no malware, no phishing, and no unusual login from the end-user perspective.

Exfiltration targeted three data classes: (1) CRM records (Salesforce accounts, opportunities, contacts — particularly from Context.ai customers in the defense, fintech, and healthcare verticals), (2) Slack DMs and private channel history for executive and security-team conversations, and (3) Google Drive documents matching regex patterns for API keys, AWS credentials, and SSO SAML signing certificates. Wiz observed at least 14 victim tenants from which secondary compromise followed — attackers used Drive-harvested AWS keys to provision compute in victim AWS accounts, and used harvested SAML signing certificates to forge session tokens for downstream SaaS apps (Golden SAML pattern, T1606.002).

Context.ai rotated all OAuth refresh tokens and revoked customer integrations on 2026-04-19, forcing every customer to re-authorize. CISA issued an alert the same day urging all Context.ai customers to (a) audit OAuth-connected applications in each SaaS tenant for the Context.ai app and revoke if unused, (b) review 30 days of API activity for the Context.ai application against the published IOC ranges, and (c) rotate any credentials, certificates, or tokens that may have been stored in connected Google Drive, SharePoint, or Notion workspaces.

The incident is representative of a growing class of SaaS integration-layer supply chain attacks (analogues: Okta support breach 2023, Snowflake credential abuse 2024, Midnight Blizzard / Microsoft OAuth 2024). It does not correspond to a software CVE — there is no vulnerable version to patch — and detection relies entirely on SaaS audit-log anomaly analytics, OAuth app inventory hygiene, and rigorous data-access scope review.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.008 Malvertising
- T1199 Trusted Relationship
- T1078.004 Valid Accounts: Cloud Accounts
- T1528 Steal Application Access Token
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Cloud Instance Metadata API
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1606.002 Forge Web Credentials: SAML Tokens
- T1526 Cloud Service Discovery
- T1087.004 Account Discovery: Cloud Account
- T1550 Use Alternate Authentication Material
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1114.002 Email Collection: Remote Email Collection
- T1071.001 Application Layer Protocol: Web Protocols
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1537 Transfer Data to Cloud Account

## Sources

- [Wiz Research: Context.ai OAuth Token Compromise](https://www.wiz.io/blog/context-ai-oauth-token-compromise)
- [Context.ai Security Incident Disclosure](https://context.ai/security/incident-2026-04)
- [CISA Alert AA26-110A: SaaS OAuth Token Abuse in Supply Chain Attacks](https://www.cisa.gov/news-events/alerts/2026/04/20/saas-oauth-supply-chain)
- [BleepingComputer: Context.ai OAuth token breach exposes SaaS supply chain](https://www.bleepingcomputer.com/news/security/context-ai-oauth-token-breach-saas-supply-chain/)
- [MITRE ATT&CK: T1528 Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)
- [MITRE ATT&CK: T1199 Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
- [Salesforce Admin Advisory: Revoking Context.ai Connected App](https://help.salesforce.com/s/articleView?id=context-ai-2026-04)
- [Google Workspace Security: Blocking Context.ai Third-Party App](https://support.google.com/a/answer/context-ai-2026-04)
- [Wiz IOC List (Context.ai OAuth Abuse)](https://github.com/wiz-sec/IOCs/blob/main/2026/context-ai-oauth-abuse.csv)
- [CSA OAuth 2.0 Best Current Practice (RFC 9700)](https://datatracker.ietf.org/doc/rfc9700/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0398