The breach originated from a compromise of Context.ai after being used by a Vercel employee. The attacker gained control of the employee's Google Workspace account and used it to access their Vercel account. From there, they pivoted into Vercel's environment and maneuvered through systems to enumerate and decrypt non-sensitive environment variables. Investigation revealed that a Context.ai employee was infected with Lumma Stealer malware in February 2026 after searching for Roblox auto-farm scripts and game exploit executors, which may have been the initial infection point. The attack involved OAuth integrations that can inherit trust from users and organizations, allowing attackers to avoid some security controls.