Vercel CEO updates on security incident investigation: attackers have distributed malware on a broader scale

On April 23, it was reported that Guillermo Rauch, CEO of the front-end cloud platform Vercel, posted on Twitter that the team has completed an in-depth security investigation, analyzing nearly 1PB of complete Vercel network and API logs, far beyond the initial Context.ai account intrusion incident.
The investigation shows that the attacker’s activity scope extends beyond Context.ai and has distributed malware on a broader scale, aiming to steal account keys from platforms like Vercel. Once the keys are obtained, the attacker will quickly and comprehensively enumerate non-sensitive environment variables.
Current measures include deepening cooperation with industry partners such as Microsoft, AWS, and Wiz to jointly protect a wider internet ecosystem; other suspected victims have been notified, and it is recommended to immediately rotate credentials and strengthen security best practices.