Vercel Got Hacked Through an
AI Tool You've Never Heard Of 😱

If you've ever deployed a Next.js app with a single git push, you've used Vercel. 🚀

Vercel is the cloud platform that powers the deployment of millions of web applications. It's the company behind Next.js — the React framework that runs a huge chunk of the modern web. Companies like Airbnb, TikTok, GitHub, and thousands of startups trust Vercel to host their production apps.

That last part — the secrets — is exactly what made this breach so serious.

This breach didn't happen overnight. It was a slow, methodical supply chain attack that started two months before Vercel even knew anything was wrong. 😣

This is where it gets technically fascinating — and terrifying. 🤔 The attacker never needed to directly hack Vercel. They got in through a side door that nobody was watching.

Step 1: What is Context.ai?

Context.ai is a small enterprise AI platform. It builds AI agents trained on your company's internal knowledge, Slack conversations, docs, workflows. Companies connect it to their Google Workspace so it can read emails, docs, and calendar events to give context-aware AI responses.

Sounds harmless, right? 🤷‍♂️ Here's the problem: when you connect a tool to your Google Workspace, you grant it an OAuth token — a digital pass that says "this app can act on behalf of our org." If that token gets stolen, the attacker can act as your org.

Step 2: What is Lumma Stealer?

Lumma Stealer (also called LummaC2) is one of the most dangerous pieces of malware active today. It's sold as Malware-as-a-Service on dark web forums — meaning anyone with a few hundred dollars can buy and deploy it. It silently:

• Harvests saved passwords from Chrome, Firefox, Edge
• Steals session cookies (so attackers bypass 2FA)
• Exfiltrates OAuth refresh tokens from local storage
• Captures crypto wallet seeds
• Sends everything to a command-and-control server

Step 3: OAuth as a Weapon

OAuth is the "Login with Google" system you see everywhere. Here's how it works normally:

When Context.ai's internal employee got infected by Lumma Stealer, the attacker got the OAuth refresh tokens for Context.ai's Google app. A refresh token is a long-lived credential that lets the app continuously get new access tokens without asking the user again. With that:

The Suspicious OAuth App ID

Vercel published a specific Google OAuth app ID that administrators should check for and revoke:

# OAuth Client ID to look for in your Google Workspace admin console
110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com

# Steps to check:
# 1. Google Admin Console → Security → API Controls → App Access Control
# 2. Search for this Client ID
# 3. If found → Revoke access immediately

To understand what was stolen, you need to understand what environment variables are — and why they're the crown jewels of any deployed application. 🔐

What Lives in .env Files

Here's a typical .env file for a modern web app — the kind of thing that lives in Vercel's environment store:

# Database
DATABASE_URL=postgresql://user:password@host:5432/mydb

# Payment Processing
STRIPE_SECRET_KEY=sk_live_51AbCdEfGhIjKlMnOpQrStUvWxYz...

# Authentication
NEXTAUTH_SECRET=super-secret-32-char-random-string
JWT_SIGNING_KEY=another-very-secret-key

# Third-party APIs
OPENAI_API_KEY=sk-proj-abc123...
SENDGRID_API_KEY=SG.xxxxxxxxxxxxxxxxxxx
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

# Crypto / Web3
WALLET_PRIVATE_KEY=0xabc123...
ALCHEMY_API_KEY=alch_xxxxxxxxxxxx

If an attacker gets your DATABASE_URL, they can read and write every record in your database. If they get your STRIPE_SECRET_KEY, they can charge customers or steal funds. If they get your WALLET_PRIVATE_KEY, crypto is gone instantly and irreversibly. 😵

Vercel's "Sensitive" vs "Non-Sensitive" Split

Vercel has a feature where you can mark environment variables as "sensitive." Sensitive vars are encrypted at rest and never shown in plaintext — not even to you after saving. The attacker only accessed variables NOT marked as sensitive.

Before vs After: How to Mark Secrets Properly

# Add a sensitive secret (encrypted, never shown again)
vercel env add DATABASE_URL production --sensitive

# Or via vercel.json
{
  "env": {
    "DATABASE_URL": {
      "value": "@database-url",
      "sensitive": true   // ← This is what protects you
    }
  }
}

Before the breach was even publicly confirmed, a post appeared on BreachForums — the internet's most active dark web marketplace for stolen data. 🌑

Who Are ShinyHunters?

ShinyHunters is one of the most notorious hacking groups operating today. Their past hits include:

• Ticketmaster — 560 million records sold for $500K (2024)
• AT&T — 70 million customer records
• Microsoft — 500 GB of source code
• Tokopedia — 91 million user accounts

Here's the twist: known ShinyHunters-linked actors denied involvement in the Vercel breach. Whether that means it's a copycat using their brand, or they genuinely weren't behind it, remains unclear. The name "ShinyHunters" may have been used to demand a higher price — their reputation commands premium ransom. 🤔

What Was Listed for Sale

A sample data file was shared publicly to prove the breach was real. It contained ~580 records of Vercel employee information. This is a standard hacker tactic — post a small sample to prove authenticity, then sell the full dump.

For most enterprise software breaches, the impact stays contained. This one cascaded hard — especially in the Web3 and crypto world. 💥

Why Crypto Teams Were Hit Hardest

Crypto and DeFi applications typically store incredibly sensitive values in environment variables:

• RPC API Keys (Alchemy, Infura, QuickNode) — used to read/write blockchain data
• Wallet private keys — for hot wallets used in automated transactions
• Smart contract deployer keys — can upgrade or destroy contracts
• Multi-sig thresholds — bypass parameters for protocol governance

The Cascading Effect

You didn't do anything wrong. Your code was fine. But because your app lived on Vercel and your secrets weren't marked sensitive — your users are now potentially at risk. This is the brutal nature of supply chain attacks: the victim of the breach isn't necessarily the one who made the mistake.

Who Was Actually Affected?

Vercel stated a "limited subset" of customers was affected and is reaching out to them directly. The company did not publish exact numbers, which is standard practice during active incident investigation. However, the affected group likely includes any customer whose:

• Account was accessible via the compromised employee's access path
• Environment variables were not marked as sensitive
• Projects had been recently accessed or deployed

Within hours of the breach being confirmed, Vercel moved fast. Here's what they did: ✅

What Vercel Said About Sensitive Variables

Vercel's official statement clarified an important technical detail:

This is significant — it means the damage wasn't as catastrophic as it could have been. If all environment variables had been exposed, this could have been one of the worst developer infrastructure breaches in history. The sensitive flag saved a lot of developers from a very bad day.

What Vercel Is Changing

Beyond the immediate response, Vercel is implementing:

• Stricter OAuth app vetting — Third-party tools will require higher verification before getting broad workspace access
• Anomaly detection on env var access — Unusual patterns of accessing environment configuration will trigger alerts
• Mandatory sensitive flag prompts — The UI will now prompt users to mark secrets as sensitive when common patterns are detected (e.g., variable names containing KEY, SECRET, TOKEN, PASSWORD)
• Context.ai integration audit — All third-party OAuth integrations are being reviewed for scope creep

Let's turn this incident into something useful. Here's what every developer and engineering team should walk away with. 💪

🔴 Immediate Actions (Do These Today)

# Generate new secrets
NEXTAUTH_SECRET=openssl rand -base64 32
DATABASE_PASSWORD=# Rotate in your DB provider's dashboard
STRIPE_SECRET_KEY=# Roll in Stripe dashboard → API Keys
JWT_SECRET=openssl rand -hex 64

# Update in Vercel
vercel env rm NEXTAUTH_SECRET production
vercel env add NEXTAUTH_SECRET production --sensitive

# Redeploy
vercel --prod

🟡 Short-Term (This Week)

🟢 Long-Term (Best Practices)

📰 Official Sources

• 🔗 Vercel April 2026 Security Bulletin (Official)
• 🔗 The Hacker News — Vercel Breach Tied to Context.ai Hack
• 🔗 BleepingComputer — Vercel Confirms Breach

📊 Coverage & Analysis

• 🔗 The Register — Cloud Dev Platform Breach Coverage
• 🔗 CoinDesk — Crypto Developers Scrambling to Lock Down API Keys
• 🔗 InfoStealers — Breach Linked to Lumma Infostealer at Context.ai
• 🔗 Cryptopolitan — Supply Chain Risk Analysis

🛠️ Security Resources

• 🔗 GitHub — Vercel April 2026 Incident Response Playbook
• 🔗 Hacker News Discussion

Found this helpful? Share it! 🚀