FlagThis

Abstract

An OAuth-based supply chain attack via Lumma Stealer at Context.ai compromised Google Workspace OAuth tokens, leading to unauthorized access to Vercel's internal systems and exposure of non-sensitive environment variables, highlighting weaknesses in OAuth trust relationships and SaaS data protection practices.