Vercel identified additional customer accounts compromised in a security incident linked to Context.ai. The breach originated from a Context.ai employee's Google Workspace account, compromised by Lumma Stealer, which then allowed access to Vercel's internal systems and environment variables.
Initial Access
Stealer's First Strike
confirmed
A Context.ai employee was infected with Lumma Stealer malware in February 2026 after searching for Roblox auto-farm scripts and game exploit executors.
Defender cut points
Implement endpoint detection and response (EDR) to detect malware executionEnforce strict web browsing policies to prevent access to untrusted software download sitesProvide security awareness training to employees on safe software downloads and supply chain risks
