Loading story…
Vercel disclosed that attackers accessed some internal systems after compromising Context.ai, an AI productivity tool used by a Vercel employee, and abusing broad Google Workspace OAuth permissions granted to the app. Using a valid OAuth token, the attacker reportedly took over the employee’s corporate account and pivoted through single sign-on into internal resources, including issue trackers, admin tools, and certain company environments. Vercel said some internal data and customer environment variables were exposed, including a limited number of customer credentials and API keys that had been classified as non-sensitive but were still usable.
The company notified affected customers and told them to rotate credentials while it investigated with Mandiant, other external firms, and law enforcement. Context.ai separately said a March intrusion into its AWS environment involved compromised OAuth tokens affecting some consumer users, linking that earlier breach to the later access into Vercel. Reporting also said the stolen Vercel data was offered for sale for $2 million by actors claiming ties to ShinyHunters, though known members denied involvement, and the incident has intensified scrutiny of SaaS integrations with excessive OAuth scopes and enterprise SSO access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By April 20, 2026, Vercel disclosed that some internal systems had been accessed through the compromised third-party AI tool Context.ai and said a limited number of customer credentials were affected. The company notified impacted customers, advised them to rotate credentials, and said it was investigating with Mandiant, other external firms, and law enforcement.
After the intrusion, stolen Vercel data was advertised for sale on the dark web for $2 million by a group claiming affiliation with ShinyHunters. Reported ShinyHunters members denied involvement.
In April 2026, after a Vercel employee had authorized Context.ai with broad Google Workspace permissions, an attacker used a valid OAuth token to take over the employee's Google Workspace account and pivot via SSO into Vercel internal systems. The attacker accessed issue trackers, internal environments, admin tools, and environment variables, including some usable customer API keys that had been marked non-sensitive.
In March 2026, Context.ai said an attack led to unauthorized access to its AWS environment through compromised OAuth tokens, affecting some consumer users. This compromise later became the foothold used in the Vercel incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecoalitioninc.com
Open sourcehalborn.com
Open sourceinfostealers.com
Open sourcecybersecuritydive.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Vercel confirmed a security incident involving unauthorized access to certain internal systems after a threat actor using the name **ShinyHunters** claimed to be selling allegedly stolen company data on a hacking forum. The company said only a limited subset of customers was affected, its services remain operational, and it has engaged incident response experts, notified law enforcement, and is working directly with impacted customers. The actor claimed the stolen data included access keys, source code, database data, internal deployment access, and API keys, and shared a text file with 580 employee-related records along with a screenshot purportedly showing an internal Vercel Enterprise dashboard. Vercel advised customers to review environment variables and rotate secrets if necessary, while the authenticity of the leaked materials and the attribution to **ShinyHunters** remained unverified; the actor also claimed on Telegram that a **$2 million** ransom demand had been discussed with the company.
Jun 29, 2026
Palo Alto Networks Unit 42 disclosed a weakness in **Google Cloud Vertex AI** that could let attacker-controlled AI agents extract credentials from the platform’s Per-Project, Per-Product Service Agent (`P4SA`) and use them to access customer resources. The issue affects deployments built with the **Agent Development Kit** through **Agent Engine**, where excessive default permissions weakened isolation between the AI agent runtime and the customer’s Google Cloud project. Researchers said exposed service-agent credentials could be abused to gain broad read access to **Google Cloud Storage** data and to view restricted Google-owned **Artifact Registry** repositories linked to Vertex AI infrastructure. Unit 42 said the flaw also exposed details about internal Google infrastructure and potentially proprietary code associated with the **Vertex AI Reasoning Engine**. Researchers further warned that insecure Python `pickle` usage and broad, non-editable **OAuth 2.0** scopes could expand the blast radius beyond GCP into **Google Workspace** services such as Gmail, Google Calendar, and Google Drive. Google responded by updating its guidance and urging customers to adopt **Bring Your Own Service Account (BYOSA)** and least-privilege controls to reduce the risk.
Jun 29, 2026
Attackers breached **Klue**, a market intelligence platform, by abusing a compromised legacy integration credential and planting malicious code that harvested customer OAuth tokens from Klue's integration infrastructure. The stolen tokens were then used to access connected **Salesforce** environments through the Klue Battlecards app and exfiltrate CRM data via Salesforce REST API queries, with reporting describing automated Python-based collection, burst querying, and use of endpoints such as `/services/data/v59.0/query/*`. Klue said it detected unauthorized activity on June 12, revoked affected credentials and tokens, removed the malicious code, disabled impacted integrations, engaged CrowdStrike, and notified law enforcement, while **Salesforce** separately disabled the Klue Battlecards connection and said the incident did not result from a vulnerability in the Salesforce platform itself. The breach has been linked by Huntress and other responders to the **Icarus** extortion group, which allegedly sent ransom emails and threatened to leak stolen data on its site. Publicly disclosed victims include Huntress, Recorded Future, Jamf, Tanium, HackerOne, OneTrust, Snyk, Sprout Social, Gong, Insurity, and others, with exposed information generally limited to business CRM records such as contacts, account data, quotes, sales communications, and contract-related details. Affected companies said there was no evidence that core products, internal infrastructure, passwords, payment card data, engineering systems, or customer security telemetry were compromised, but several warned that the stolen contact data could be used in follow-on phishing and social engineering campaigns.
Jul 14, 2026