Vercel April 2026 Security Incident — Context.ai OAuth Supply Chain Compromise Exposing Employee Records, Plaintext Environment Variables, and npm/GitHub Tokens
Vercel April 2026 Security Incident (TL-2026-0400), also tracked as Vercel Breach April 2026, is a high-severity supply-chain compromise scored CVSS 8.1, first published 2026-04-21. It is attributed to ShinyHunters (France) with medium confidence, affects Vercel Vercel Platform (Dashboard + Deployment Environments), maps to 19 MITRE ATT&CK techniques (T1021, T1078, T1087), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-0400
- Threat ID
- TL-2026-0400
- Also known as
- Vercel Breach April 2026, Context.ai Supply Chain Compromise, Vercel ShinyHunters Incident
- Severity
- HIGH
- CVSS
- 8.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L)
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-04-21
- Last reviewed
- 2026-04-21
- Attribution
- ShinyHunters
- Attribution confidence
- MEDIUM
- Nation-state nexus
- France
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, saas, cloud-services, startups, e-commerce, media
- Target regions
- Global, North America, Europe, Asia Pacific
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Vercel April 2026 Security Incident
Malware and tooling: Telegram (extortion channel)
On April 19-20, 2026, Vercel disclosed a security incident in which a threat actor (claiming ShinyHunters affiliation) exploited a compromise of third-party AI assistant Context.ai to hijack a Vercel employee's Google Workspace account via a malicious OAuth application, then pivoted into Vercel's internal systems. The attacker exfiltrated non-sensitive plaintext environment variables, 580 employee records, select source code, internal deployment database data, and npm/GitHub tokens, subsequently demanding a $2M ransom and offering stolen data for sale on hacking forums. Next.js, Turbopack, and all Vercel-published npm packages were confirmed uncompromised in collaboration with GitHub, Microsoft, npm, and Socket.
How Vercel April 2026 Security Incident works
## Incident Overview
Vercel Inc., the cloud platform hosting millions of Next.js, Turbopack, and SvelteKit applications, disclosed a security incident on April 19, 2026, and expanded the disclosure on April 20, 2026. The attack chain is a canonical third-party/AI-tool supply chain compromise: an unrelated breach of Context.ai (an AI productivity assistant with broad Google Workspace scopes) was leveraged by the threat actor to take over a Vercel employee's Google Workspace identity through a malicious OAuth application, from which the attacker pivoted into internal Vercel environments.
## Attack Chain
1. **Upstream Context.ai compromise.** The initial access vector was a compromise at AI tool vendor Context.ai, a third-party SaaS integrated into Vercel employee workflows via Google Workspace OAuth grants. The specific Context.ai breach details remain vendor-sensitive, but the downstream artifact is the presence of a malicious OAuth application (ID `110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com`) consented into hundreds of users' Google Workspaces across many organizations. 2. **OAuth application abuse (MITRE T1528 / T1550.001).** The malicious application possessed enough scope to read mail, drive, and identity metadata, allowing the attacker to operate with the employee's Google Workspace privileges without needing the primary account password or bypassing MFA at login time. 3. **Internal pivot.** Using the hijacked identity, the attacker enumerated and accessed internal Vercel systems exposed to employee identity, including dashboards, deployment metadata, and certain internal code/data stores. 4. **Credential theft.** The attacker harvested non-sensitive (plaintext-decrypted) environment variables belonging to a limited subset of customers, internal database data from deployments, and npm/GitHub tokens held by the employee. Environment variables flagged as "sensitive" (encrypted-at-rest) were not readable. 5. **Employee data theft.** 580 employee records — names, email addresses, account status, and activity timestamps — were exfiltrated from an internal HR/dashboard interface. 6. **Extortion and sale.** On April 20, a threat actor claiming ShinyHunters affiliation posted stolen data on hacking forums, attached screenshots of internal Vercel dashboards as proof, and demanded $2 million via Telegram. Individuals associated with the historical ShinyHunters collective publicly denied involvement, but the tradecraft (data theft + forum sale + Telegram extortion) is consistent with the group's modus operandi.
## Data Exposed
- Plaintext-decrypted non-sensitive environment variables for a limited subset of Vercel customers (API keys, tokens, and database credentials that the customer had not marked sensitive) - 580 Vercel employee records (PII: names, emails, account status, last activity) - Select internal source code - Database data from internal deployments - npm and GitHub personal access tokens belonging to the compromised employee - Screenshots of internal Vercel admin dashboards
## Data NOT Exposed
- Environment variables marked sensitive (encrypted at rest, unreadable from the compromised interface) - Next.js, Turbopack, and every npm package published under Vercel-owned namespaces — validated as uncompromised by a joint review involving GitHub, Microsoft, npm (GitHub Advanced Security), and Socket. No malicious commits or package versions were published.
## Vercel Response
Vercel engaged Mandiant and additional incident-response firms, coordinated with law enforcement, revoked all tokens belonging to the compromised employee, rotated internal secrets, and shipped product enhancements — most notably flipping the default for new environment variables to "sensitive" (encrypted), requiring an explicit opt-out to store plaintext.
## Why This Threat Matters
The incident is a textbook demonstration of the blast radius of AI-tool supply chain trust. A single third-party AI assistant with broad Google Workspace OAuth scopes, compromised upstream, became the initial access vector for a cloud PaaS provider hosting millions of applications. The same class of attack applies to any organization whose employees have installed AI assistants, code-review bots, meeting note takers, or CRM copilots with expansive OAuth grants. Detection must focus on OAuth application auditing, cloud identity abuse, and outbound data flows from SaaS into attacker-controlled applications, not just endpoint or network telemetry.
MITRE ATT&CK techniques used in TL-2026-0400
Lateral Movement
Defense Evasion
Discovery
T1087 Account Discovery; T1526 Cloud Service Discovery
Collection
T1114 Email Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship; T1566 Phishing
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Exfiltration
T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service
lateral-movement
T1550 Use Alternate Authentication Material
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts
Impact
Affected products and versions in Vercel April 2026 Security Incident
- Vercel — Vercel Platform (Dashboard + Deployment Environments)
Vulnerable versions: All tenants with plaintext environment variables as of 2026-04-19
Fixed in: Platform as of 2026-04-20 with mandatory-sensitive env var defaults - Context.ai — Context.ai AI Assistant
Vulnerable versions: All versions integrated via Google Workspace OAuth prior to 2026-04-19 - Google — Google Workspace (as abused channel — not a vulnerability in Google Workspace itself)
Vulnerable versions: Tenants that permitted user-installed third-party OAuth apps
Fixed in: Tenants enforcing admin-approved-apps-only policy
Remediation for Vercel April 2026 Security Incident
Patches
- Vercel platform update (April 20, 2026): new environment variables default to sensitive/encrypted storage — no user action required for new variables created after this date
- Vercel platform update (April 20, 2026): added monitoring for anomalous access to plaintext environment variable decrypt endpoints
Immediate actions
- Rotate all non-sensitive Vercel environment variables immediately — assume any plaintext secret in a Vercel project dashboard prior to April 19, 2026 is compromised
- Rotate all npm publish tokens and GitHub personal access tokens stored in Vercel projects or used by Vercel engineering workflows
- Audit Google Workspace OAuth application grants for application ID 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com and revoke immediately if present
- Audit Vercel deployment logs and activity logs for the window April 15-20, 2026 for anomalous access, token usage, and deployments
- Enable mandatory MFA on all Vercel team member accounts
- Mark all existing environment variables as sensitive in Vercel project settings (migrate plaintext variables)
Workarounds
- If Google Workspace admin-approved apps cannot be enforced, minimally restrict OAuth scopes: deny any third-party app requesting 'https://www.googleapis.com/auth/drive' or 'https://mail.google.com/' unless explicitly approved
- Block outbound DNS resolution to context.ai and known AI-assistant domains from employee endpoints pending vendor security validation
Longer-term hardening
- Establish an OAuth application allowlist in Google Workspace (admin-approved apps only) and block user-installed third-party apps by default
- Implement periodic review of all Google Workspace OAuth grants with automated revocation of apps unused for 30+ days
- Move secrets out of PaaS environment variable stores into dedicated secrets managers (HashiCorp Vault, AWS Secrets Manager, Doppler) with short-lived credential vending
- Deploy SaaS Security Posture Management (SSPM) tooling to detect and alert on high-privilege OAuth consents
- Adopt short-lived OIDC-based npm publishing (Trusted Publishing) to eliminate long-lived npm tokens
- Scope GitHub personal access tokens to fine-grained permissions, never classic tokens, with 30-day expiry
Weaknesses (CWE) in Vercel April 2026 Security Incident
CWE-287, CWE-522, CWE-862, CWE-798, CWE-1021, CWE-311
Timeline of Vercel April 2026 Security Incident
- Estimated window of Context.ai compromise and malicious OAuth app distribution to Google Workspace tenants, based on Vercel's activity log review (exact vendor incident date undisclosed).
- Attacker pivots from compromised Context.ai-granted OAuth app into a Vercel employee's Google Workspace account, then into internal Vercel systems. Begins enumeration, harvesting plaintext environment variables, employee records, source code, and npm/GitHub tokens.
- Vercel publishes initial security bulletin at 11:04 AM PST describing the incident; at 6:01 PM PST adds attack origin details naming Context.ai as the upstream compromise and publishing the malicious OAuth app ID.
- Vercel security detects anomalous access; engages incident response (Mandiant) and begins containment.
- Vercel ships platform update: all new environment variables default to sensitive/encrypted storage, requiring explicit opt-out to store plaintext. Deploys additional monitoring on plaintext env var decrypt paths.
- BleepingComputer and SOCRadar publish detailed technical coverage of the breach, including the ShinyHunters claim and evidence screenshots.
- Vercel completes npm package validation at 5:32 PM PST in collaboration with GitHub, Microsoft, npm, and Socket. Confirms no Vercel-published npm package was tampered with. Next.js, Turbopack, and all other Vercel open-source projects confirmed safe.
- A threat actor claiming ShinyHunters affiliation posts on hacking forums offering 580 Vercel employee records, source code, database data, and npm/GitHub tokens for sale; publishes internal Vercel dashboard screenshots as proof. Threat actor also contacts Vercel via Telegram demanding $2M ransom.
- Threadlinqs Intelligence publishes comprehensive threat profile TL-2026-0400 with MITRE mapping, IOCs, detection rules, and customer guidance.
- As of 2026-05-29, the Vercel incident itself is contained (Mandiant IR, tokens revoked, env-vars now default-encrypted, Context.ai extension pulled), but stolen data was listed on BreachForums for $2M and the claimed actor ShinyHunters remains highly active (FBI IC3 advisory May 15, Canvas/Instructure breach). The Context.ai/Lumma OAuth shadow-AI supply-chain vector hit hundreds of orgs and stays actively exploited, keeping downstream risk live.
Sources cited for Vercel April 2026 Security Incident
- Vercel April 2026 Security Incident Bulletin
- Vercel confirms breach as hackers claim to be selling stolen data
- Vercel Breach: Hacker Claims to Sell Stolen Data in Potential Global Supply Chain Attack
- MITRE ATT&CK T1528 — Steal Application Access Token
- MITRE ATT&CK T1550.001 — Application Access Token
- MITRE ATT&CK T1199 — Trusted Relationship
- CISA Guidance: Securing OAuth Applications in Google Workspace
Threats related to Vercel April 2026 Security Incident
Detection coverage for TL-2026-0400
As of 2026-04-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0400 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.