In April 2026, attackers didn't hack Vercel — one of the most popular cloud deployment platforms in the world, trusted by millions of developers and thousands of enterprises. They hacked a smaller company called Context.ai. They stole its Google Workspace OAuth tokens. And then they walked right through Vercel's front door.
No brute-force. No zero-day exploit. No sophisticated technical magic. Just a stolen key, used exactly as it was designed to be used. This is the OAuth supply chain attack — and it is quietly becoming the most devastatingly effective attack vector in enterprise cybersecurity.
First: What Is OAuth and Why Does Everyone Use It?
OAuth 2.0 is the authorisation framework that powers the interconnected cloud ecosystem. When you click "Sign in with Google" on a third-party website, you're using OAuth. When you connect your Slack workspace to Jira, your HubSpot to Salesforce, or your GitHub to a CI/CD pipeline — you're using OAuth.
The protocol works by creating delegated authorisation tokens: rather than sharing your actual password with a third-party service, you grant that service a token that gives it specific, scoped access to act on your behalf. It's elegant, it's convenient, and it's the foundation of the SaaS ecosystem. It's also a massive, largely unmonitored attack surface.
A valid OAuth token, used by an attacker, looks exactly like a legitimate service doing its normal job. No failed logins to flag. No unusual authentication patterns. No malware signatures. No impossible travel alerts. The attacker is literally using a valid credential to perform authorised-looking actions. Traditional security controls are largely blind to this.
The Vercel Breach: A Step-by-Step Anatomy
The April 2026 Vercel incident is worth examining in detail because it illustrates the complete attack chain with unusual clarity.
The 700-Organisation Cascade: When One Breach Becomes Seven Hundred
In early 2026, attackers compromised OAuth tokens from both Drift and Salesloft. Both platforms had deep OAuth integrations with Salesforce. By exploiting the compromised tokens, attackers accessed Salesforce environments at over 700 organisations. One breach cascade. Seven hundred victims.
This is the multiplier effect that makes OAuth supply chain attacks so extraordinarily dangerous. Consider where the cascade could hit hardest:
The question is not whether your vendor relationships create this kind of risk — they do. The question is whether you have mapped and managed that risk. Most organisations haven't.
The Shadow IT Explosion: OAuth Grants Nobody Authorised
In the average enterprise, the number of SaaS applications in active use is typically three to five times the number officially sanctioned by IT. Every unsanctioned OAuth connection creates a trust relationship that:
- →May grant the new tool access to corporate data beyond what is strictly necessary
- →Is typically invisible to the security team and never reviewed
- →May involve a vendor with a security posture far below enterprise standards
- →May never be revoked when the employee stops using the tool or leaves the company
OAuth grants that are never revoked are permanently active attack vectors. An employee who connected a personal productivity app to their corporate Google Workspace three years ago, forgot about it, and has since left the company may have left behind an active OAuth connection to an app the company knows nothing about.
The Full Attack Chain: Phase by Phase
Understanding the attack chain helps security teams identify where defensive controls can have the most impact:
Defending Against OAuth Supply Chain Attacks: 5 Pillars
OAuth supply chain attacks are defensible. The key is visibility, governance, and monitoring — applied rigorously to your OAuth ecosystem:
- Conduct a comprehensive audit of every OAuth connection — Google Workspace, Microsoft 365, Salesforce, GitHub, and cloud infrastructure
- Use tools like Microsoft Entra, Google Workspace Admin Console, Okta SaaS Management, Nudge Security, or a dedicated CASB solution
- Most organisations discover hundreds of OAuth grants they were unaware of — many from apps no longer in use
- Enforce least-privilege OAuth scopes — an app that reads email subjects should not be able to send email on your behalf
- Require security review and approval before any third-party application is granted OAuth access to corporate resources
- Assess vendor security posture before granting access — consider requiring SOC 2 Type II and completing security questionnaires
- Implement a regular process to identify and revoke unused OAuth grants — old PoC connections are unnecessary permanent risk
- Enforce aggressive token expiry windows where feasible — hours, not months
- For high-value integrations, implement automated token rotation to limit stolen-token usability windows
- Establish behavioural baselines for normal OAuth token usage — which apps use which tokens, at what times, from what IP addresses
- Implement detection logic that correlates OAuth activity across services — cross-context token usage is a high-fidelity signal
- Subscribe to threat intelligence feeds that specifically cover SaaS vendor compromises and OAuth token theft campaigns
- Build specific incident response playbooks for OAuth supply chain scenarios — how to rapidly revoke all OAuth access from a specific vendor
- Pre-plan third-party notification procedures — knowing exactly what to do when a vendor is compromised dramatically reduces response time
New Questions for Every Vendor Security Assessment
The OAuth supply chain threat has significant implications for vendor management and third-party risk. Traditional assessments asked about security policies and certifications. Add these OAuth-specific questions to every assessment:
- Q1What OAuth access are you requesting, and what is the minimum access necessary for your service to function?
- Q2What is your process for detecting and responding to OAuth token compromise?
- Q3How do you monitor for unusual usage of the OAuth tokens you've been granted?
- Q4What is your infostealer detection and response capability — do you have controls to prevent malware like Lumma Stealer from exfiltrating tokens from employee devices?
- Q5What is your incident notification timeline and process if you discover a compromise?
The Bigger Picture: A World of Interconnected Trust
The OAuth supply chain threat is a symptom of a much larger architectural shift. We have built an ecosystem of extraordinary interconnection — cloud services that talk to cloud services, APIs that call APIs, agents that orchestrate agents. This creates enormous value. It also creates a trust graph of staggering complexity.
Every node in that trust graph is a potential compromise point. Every edge — every OAuth connection, every API integration — is a potential attack path. The organisations that will thrive manage their trust graph deliberately: knowing what connections exist, governing what access is granted, monitoring for compromise, and responding rapidly when trust is violated.
At Woollemia Infosec, third-party risk and identity security are at the core of everything we do. We help organisations map their OAuth ecosystem, assess vendor security postures, implement detection and monitoring capabilities, and build the response plans they need for when — not if — a vendor they trust is compromised. Has your organisation done an OAuth grant audit recently?
— Woollemia Infosec, Identity & Third-Party Risk Team · +91 7760504273 / +91 9686227978