How Roblox Cheats Led to a Corporate Breach, Warship Tracked by Postcard, Passkeys Replace Passwords

[upbeat music] Right, kicking us off this week, Vercel.

If you're anywhere near cybersecurity, you've probably heard about this one because everybody's been talking about it.

Vercel breach widens, so it's got bigger.

So Vercel is the company behind the Next.js framework used by lots and lots of different people, lots of businesses, lots of websites.

Breach, the breach originated from a compromised third-party AI tool called Context AI.

The breach they announced, and they've now announced that it's even bigger than first thought.

So Context AI is an AI productivity tool that a Vercel employee was using, third-party AI tool.

An attacker took over that employee's Google Workspace account through the compromised AI tool, and then used that access to pivot into Vercel's internal systems and start decrypting customer environment variables.

So as the investigation has expanded, Vercel's now found additional compromised accounts, including some that appear to have been breached independently through social engineering or malware before this incident even began.

And Hudson Rock traced the likely patient zero to a Context.ai employee who got infected with Lumma stealer after searching for Roblox auto farm scripts.

Um, it's still unclear whether Vercel's use of Context AI office suite was officially approved or just a case of shadow AI, which is where, you know, your people use tools without asking.

Um, the, the, the pieces together on this, the journey, it's huge.

Mm-hmm.

There's so many bits to dissect from this.

You've got the shadow AI argument, so, or, or at the third-party AI argument.

I love that.

I love it.

I, I mean, I hate it, but I love it.

It's the fact that the way that they did that, an attacker took over the employee's Google Workspace account through the compromised AI tool, so they've gone back and used that access to then pivot into Vercel's internal systems.

And, and then-

Yeah

...

in investigation, they find out that there's other people that have been popped already.

And the average time, isn't it, that breaches, you only, like, you discover a breach typic- that your system is impacted 200 days or something after the initial point of, um, access.

So they've found other people on their network.