Wiz Adds APT29 to the Scattered Spider Attribution on Vercel/Context.ai Chain

Wiz Research characterizes this as a double supply-chain compromise: attackers — attributed to both APT29 and Scattered Spider — first breached Context.ai's consumer AI Office Suite environment, then leveraged compromised OAuth tokens inherited through that product to access a Vercel employee's Google Workspace account and pivot into Vercel's internal systems. No CVEs were involved; the entire attack chain ran through legitimate OAuth consent flows and token delegation, meaning no vulnerability patching would have interrupted it. Vercel has confirmed downstream customer credential exposure, and stolen data is reportedly being offered for sale, placing this firmly in the monetization phase.

The dual APT29/Scattered Spider attribution from Wiz demands scrutiny before accepting at face value — these are actors with fundamentally different motive profiles (Russian SVR intelligence collection vs. English-speaking financially-motivated crime), and co-attribution on a single incident typically indicates access brokering, independent parallel targeting, or attribution hedging under uncertainty. The more durable takeaway is the attack primitive itself: an employee installing a consumer-grade AI tool that holds OAuth refresh tokens to enterprise Google Workspace is a supply-chain trust problem that lives entirely outside patch management — OAuth application inventory, consent scope auditing, and third-party app vetting policies are the actual control surface here, and most organizations' visibility into that surface is poor.

This is the update that matters since this morning: the clean Scattered Spider picture from the first disclosure wave has gotten muddier, not clearer. Co-attribution across SVR intelligence-collection and EN-speaking cybercrime on the same incident almost never survives scrutiny as a single-actor story — watch for this to resolve into access brokering, borrowed tooling, or one vendor quietly retracting. Either way, the OAuth-consent-graph attack primitive is the durable lesson; no amount of patching touches it.