Vercel Breach Analysis: Third-Party AI Supply Chain Attack via Compromised Context.ai

---
title: Potential Connection to Compromised AI Vendor Context.ai
id: 3c8f7d21-9a4e-4f1b-b8c0-1e2d3a4b5c6f
status: experimental
description: Detects network connections to Context.ai domains, which may be associated with a compromised third-party tool or unauthorized data exfiltration. 
references:
  - https://securityaffairs.com/191031/data-breach/third-party-ai-hack-triggers-vercel-breach-internal-environments-accessed.html
author: Security Arsenal
date: 2025/02/03
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'context.ai'
      - 'ctx.ai'
  condition: selection
falsepositives:
  - Legitimate use of Context.ai by authorized personnel
level: medium
---
title: Suspicious PowerShell Spawn from Browser Process
id: 5e1f9b88-7d2e-4a5c-9f1a-2b3c4d5e6f7a
status: experimental
description: Detects PowerShell or CMD spawned by a browser process. This may indicate an attacker who has gained session access via OAuth attempting to move laterally or execute commands on the endpoint.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2025/02/03
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative troubleshooting or DevOps workflows
level: high

// Hunt for connections to Context.ai or related AI SaaS endpoints
let RiskDomains = dynamic(["context.ai", "ctx.ai"]);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (RiskDomains)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, ActionType
| summarize Count = count() by DeviceName, InitiatingProcessAccountName, RemoteUrl
| order by Count desc

-- Hunt for browser history related to Context.ai
SELECT 
  Timestamp, 
  URL, 
  Title, 
  Username,
  BrowserType
FROM chrome_history(urlContains='context.ai')
-- Note: Adjust to firefox_history() or brave_history() based on environment standards

# Incident Response Script: Clean Browser Sessions and Check for Persistence
# Run as Administrator

Write-Host "[+] Initiating containment for potential OAuth token theft..." -ForegroundColor Cyan

# 1. Clear Chrome Cache (Token storage)
$chromePaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data",
    "$env:APPDATA\Google\Chrome\User Data"
)

Write-Host "[*] Stopping Chrome processes..."
Stop-Process -Name chrome -ErrorAction SilentlyContinue

foreach ($path in $chromePaths) {
    if (Test-Path $path) {
        Write-Host "[*] Clearing cache at $path..."
        Get-ChildItem -Path "$path\*\Cache" -Recurse -ErrorAction SilentlyContinue | Remove-Item -Force -Recurse
        Get-ChildItem -Path "$path\*\Code Cache" -Recurse -ErrorAction SilentlyContinue | Remove-Item -Force -Recurse
        Get-ChildItem -Path "$path\*\Local Storage" -Recurse -ErrorAction SilentlyContinue | Remove-Item -Force -Recurse
    }
}

Write-Host "[*] Clearing Edge Cache..."
Stop-Process -Name msedge -ErrorAction SilentlyContinue
$edgePaths = @(
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data",
    "$env:APPDATA\Microsoft\Edge\User Data"
)
foreach ($path in $edgePaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path "$path\*\Cache" -Recurse -ErrorAction SilentlyContinue | Remove-Item -Force -Recurse
        Get-ChildItem -Path "$path\*\Code Cache" -Recurse -ErrorAction SilentlyContinue | Remove-Item -Force -Recurse
    }
}

# 2. Hunt for Suspicious Scheduled Tasks (Persistence)
Write-Host "[*] Checking for suspicious scheduled tasks created in the last 24 hours..."
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-1) }

if ($suspiciousTasks) {
    Write-Host "[!] Warning: Found recently created tasks:" -ForegroundColor Yellow
    $suspiciousTasks | Select-Object TaskName, Date, Author, Action | Format-Table
} else {
    Write-Host "[+] No suspicious tasks found." -ForegroundColor Green
}

Write-Host "[+] Remediation script completed. Please force-password reset the associated user account in Google Workspace." -ForegroundColor Green