← Back to feed
2026-05-10 Supply ChainShadow AI TLP:CLEAR

Context.ai OAuth Compromise Pivots to Vercel via Lumma Stealer and Overpermissioned Google Workspace Integration

Date: 2026-05-10
Tags: supply-chain, shadow-ai

Executive Summary

A Context.ai employee was compromised with Lumma Stealer malware in February 2026, and a threat actor claiming ShinyHunters responsibility used compromised OAuth tokens to pivot into Vercel's Google Workspace account, exposing customer credentials and claiming $2 million in stolen data. The attacker gained access to a Vercel employee's Google Workspace account through a compromised Context AI browser extension, then accessed environment variables not marked as sensitive and not encrypted at rest.

Campaign Summary

FieldDetail
Campaign / MalwareContext.ai OAuth Supply Chain Pivot to Vercel
AttributionShinyHunters (claimed; ShinyHunters publicly denied involvement) (confidence: low)
TargetVercel (via compromised Context.ai employee account); potential downstream impact to hundreds of organizations using Context.ai Office Suite
VectorInfostealer malware (Lumma Stealer) → OAuth token theft → Google Workspace takeover → environment variable access
Statusactive
First Observed2026-02-01

Detailed Findings

Hudson Rock uncovered that a Context.ai employee was compromised with Lumma Stealer in February 2026, raising the possibility that the infection triggered the supply chain escalation. Context AI disclosed that an unauthorized actor gained access to their OAuth tokens, enabling access to a subset of users on their legacy and experimental products. Context.ai identified and blocked unauthorized access to its AWS environment in March 2026, but later emerged that the attacker also likely compromised OAuth tokens for some of its consumer users. The IOC referenced on Vercel's website can be found inside the Context AI Chrome Extension (omddlmnhcofjbnbflmjginpjjblphbgk), which was removed on March 27, 2026, and allowed users to search and gather information from their Google Drive files using OAuth2 Google App login, granting the Context AI app full read access to all of their Google Drive files. <ancite index="52-6,52-8">It appears at least one Vercel employee signed up for the AI Office Suite using their Vercel enterprise account and granted 'Allow All' permissions, with Vercel's internal OAuth configurations allowing this action to grant broad permissions in Vercel's enterprise Google Workspace. The corporate credentials harvested during the attack consisted of Google Workspace credentials, along with keys and logins for Supabase, Datadog, and Authkit, with the "[email protected]" account likely allowing the threat actor to escalate privileges, bypass security controls, and successfully pivot into Vercel's infrastructure. In April 2026, Vercel was compromised via an OAuth app integrated into their Google Workspace tenant stemming from a compromised third-party AI SaaS provider.

MITRE ATT&CK Mapping

TechniqueIDContext
Phishing: Spearphishing LinkT1566.002Lumma Stealer delivery vector targeting Context.ai employee
Valid Accounts: Cloud AccountsT1078.004OAuth token hijacking and Google Workspace account takeover
Unsecured Credentials: Credentials in FilesT1552.001Environment variables stored unencrypted in Vercel platform
Lateral Tool TransferT1570Pivot from Context.ai OAuth tokens into Vercel infrastructure

IOCs

Domains

beta.context.ai (no longer accessible as of April 20, 2026)

Full URL Paths

_Sourced from Vercel security bulletin and OX Security analysis; Lumma Stealer C2 infrastructure not publicly disclosed in primary sources_

Splunk Format

"beta.context.ai (no longer accessible as of April 20, 2026)"

Detection Recommendations

Monitor Google Workspace OAuth application approvals for unusually broad permissions grants (especially 'Allow All' scopes); implement OAuth scope restrictions and time-bounded token expiration; audit third-party AI tool integrations with workspace tenants for proper permission segmentation; implement environment variable encryption at rest (Vercel's 'sensitive' variable feature); enforce multi-factor authentication on workspace admin and service accounts; monitor for suspicious Chrome extension installations or removals in enterprise environments; detect infostealer infections through behavioral analytics (file system enumeration of credential stores like .ssh, .aws, .npmrc); implement CASB controls to detect unusual OAuth token usage patterns.

References