# Vercel April 2026 Security Incident — Context.ai OAuth Supply Chain Compromise Exposing Employee Records, Plaintext Environment Variables, and npm/GitHub Tokens

> On April 19-20, 2026, Vercel disclosed a security incident in which a threat actor (claiming ShinyHunters affiliation) exploited a compromise of third-party AI assistant Context.ai to hijack a Vercel employee's Google Workspace account via a malicious OAuth application, then pivoted into Vercel's internal systems. The attacker exfiltrated non-sensitive plaintext environment variables, 580 employee records, select source code, internal deployment database data, and npm/GitHub tokens, subsequently demanding a $2M ransom and offering stolen data for sale on hacking forums. Next.js, Turbopack, and all Vercel-published npm packages were confirmed uncompromised in collaboration with GitHub, Microsoft, npm, and Socket.

- **Published:** 2026-04-21T12:00:00Z
- **Last reviewed:** 2026-04-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0400
- **ID:** TL-2026-0400
- **Severity:** HIGH (CVSS 8.1)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** ShinyHunters (France)
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

## Incident Overview

Vercel Inc., the cloud platform hosting millions of Next.js, Turbopack, and SvelteKit applications, disclosed a security incident on April 19, 2026, and expanded the disclosure on April 20, 2026. The attack chain is a canonical third-party/AI-tool supply chain compromise: an unrelated breach of Context.ai (an AI productivity assistant with broad Google Workspace scopes) was leveraged by the threat actor to take over a Vercel employee's Google Workspace identity through a malicious OAuth application, from which the attacker pivoted into internal Vercel environments.

## Attack Chain

1. **Upstream Context.ai compromise.** The initial access vector was a compromise at AI tool vendor Context.ai, a third-party SaaS integrated into Vercel employee workflows via Google Workspace OAuth grants. The specific Context.ai breach details remain vendor-sensitive, but the downstream artifact is the presence of a malicious OAuth application (ID `110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com`) consented into hundreds of users' Google Workspaces across many organizations.
2. **OAuth application abuse (MITRE T1528 / T1550.001).** The malicious application possessed enough scope to read mail, drive, and identity metadata, allowing the attacker to operate with the employee's Google Workspace privileges without needing the primary account password or bypassing MFA at login time.
3. **Internal pivot.** Using the hijacked identity, the attacker enumerated and accessed internal Vercel systems exposed to employee identity, including dashboards, deployment metadata, and certain internal code/data stores.
4. **Credential theft.** The attacker harvested non-sensitive (plaintext-decrypted) environment variables belonging to a limited subset of customers, internal database data from deployments, and npm/GitHub tokens held by the employee. Environment variables flagged as "sensitive" (encrypted-at-rest) were not readable.
5. **Employee data theft.** 580 employee records — names, email addresses, account status, and activity timestamps — were exfiltrated from an internal HR/dashboard interface.
6. **Extortion and sale.** On April 20, a threat actor claiming ShinyHunters affiliation posted stolen data on hacking forums, attached screenshots of internal Vercel dashboards as proof, and demanded $2 million via Telegram. Individuals associated with the historical ShinyHunters collective publicly denied involvement, but the tradecraft (data theft + forum sale + Telegram extortion) is consistent with the group's modus operandi.

## Data Exposed

- Plaintext-decrypted non-sensitive environment variables for a limited subset of Vercel customers (API keys, tokens, and database credentials that the customer had not marked sensitive)
- 580 Vercel employee records (PII: names, emails, account status, last activity)
- Select internal source code
- Database data from internal deployments
- npm and GitHub personal access tokens belonging to the compromised employee
- Screenshots of internal Vercel admin dashboards

## Data NOT Exposed

- Environment variables marked sensitive (encrypted at rest, unreadable from the compromised interface)
- Next.js, Turbopack, and every npm package published under Vercel-owned namespaces — validated as uncompromised by a joint review involving GitHub, Microsoft, npm (GitHub Advanced Security), and Socket. No malicious commits or package versions were published.

## Vercel Response

Vercel engaged Mandiant and additional incident-response firms, coordinated with law enforcement, revoked all tokens belonging to the compromised employee, rotated internal secrets, and shipped product enhancements — most notably flipping the default for new environment variables to "sensitive" (encrypted), requiring an explicit opt-out to store plaintext.

## Why This Threat Matters

The incident is a textbook demonstration of the blast radius of AI-tool supply chain trust. A single third-party AI assistant with broad Google Workspace OAuth scopes, compromised upstream, became the initial access vector for a cloud PaaS provider hosting millions of applications. The same class of attack applies to any organization whose employees have installed AI assistants, code-review bots, meeting note takers, or CRM copilots with expansive OAuth grants. Detection must focus on OAuth application auditing, cloud identity abuse, and outbound data flows from SaaS into attacker-controlled applications, not just endpoint or network telemetry.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1566 Phishing
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1078 Valid Accounts
- T1550 Use Alternate Authentication Material
- T1526 Cloud Service Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1114 Email Collection
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account
- T1657 Financial Theft
- T1583 Acquire Infrastructure
- T1586 Compromise Accounts

## Sources

- [Vercel April 2026 Security Incident Bulletin](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident)
- [Vercel confirms breach as hackers claim to be selling stolen data](https://www.bleepingcomputer.com/news/security/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/)
- [Vercel Breach: Hacker Claims to Sell Stolen Data in Potential Global Supply Chain Attack](https://socradar.io/blog/vercel-breach-hacker-sell-stolen-data/)
- [MITRE ATT&CK T1528 — Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)
- [MITRE ATT&CK T1550.001 — Application Access Token](https://attack.mitre.org/techniques/T1550/001/)
- [MITRE ATT&CK T1199 — Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
- [CISA Guidance: Securing OAuth Applications in Google Workspace](https://www.cisa.gov/news-events/cybersecurity-advisories)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0400