Researchers Spot Uptick in Use of Vercel for Phishing Campaigns

Infosecurity Magazine

May 7, 2026 at 8:30 AM

Actively Exploited

Overview

Cofense has reported a notable rise in phishing campaigns that exploit the Vercel platform. Vercel, a popular service for frontend developers that allows for easy deployment of web applications, has been misused by attackers to create deceptive sites aimed at tricking users into providing sensitive information. This uptick in abuse is significant enough to raise alarms among cybersecurity experts, as it could affect a wide range of organizations using Vercel for their web projects. Companies relying on this platform need to be vigilant and enhance their security measures to protect against these phishing attacks. Users should also be cautious about unsolicited communications that may lead to fraudulent websites.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Vercel platform and its users
Action Required: Users should implement multi-factor authentication, regularly educate employees about phishing tactics, and monitor for suspicious activity related to their Vercel deployments.
Timeline: Newly disclosed

Original Article Summary

Cofense has warned of a “significant” increase in phishing campaigns abusing Vercel platform

Impact

Vercel platform and its users

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should implement multi-factor authentication, regularly educate employees about phishing tactics, and monitor for suspicious activity related to their Vercel deployments.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Phishing, Exploit.

Read Original Article

Related Coverage

Exploits and vulnerabilities in Q1 2026

Securelist

The report for Q1 2026 details a range of newly discovered vulnerabilities and exploits in various software and systems. Researchers have identified several Command and Control (C2) frameworks utilized in Advanced Persistent Threat (APT) attacks, which indicates a concerning trend in cybercrime tactics. This information is crucial for organizations to understand the evolving threat landscape and to take proactive measures to protect their networks. By keeping track of these vulnerabilities, companies can better defend against potential attacks that exploit these weaknesses. It’s essential for IT teams to stay updated on these findings to ensure their systems are secure.

May 7, 2026

One House Democrat is pressing Commerce on the government’s spyware use

CyberScoop

Rep. Summer Lee, a House Democrat, is raising concerns about the government's use of spyware, particularly following a confirmation from ICE that they utilize such technology. This scrutiny comes on the heels of news that a close ally of former President Trump has taken on a leadership role at NSO Group, a company known for its controversial spyware products. Lee's letter to the Commerce Department seeks to clarify the extent of government surveillance practices and their implications for privacy rights. This situation highlights ongoing debates about the balance between national security and individual privacy, especially as government agencies increasingly turn to advanced surveillance technologies. The implications of these developments could affect not only government accountability but also public trust in law enforcement agencies.

May 7, 2026

Daemon Tools Developer Confirms Software Was Trojanized

Infosecurity Magazine

The developers of Daemon Tools have confirmed that a version of their software was compromised by a group linked to China, allowing them to backdoor the program. This incident has led to the infection of thousands of users who downloaded this tainted version. The backdoor could potentially allow attackers to gain unauthorized access to infected systems, raising significant security concerns. Users who downloaded this specific version of Daemon Tools should take immediate action to secure their systems. The incident serves as a reminder of the risks associated with downloading software from unofficial sources or unverified links.

May 7, 2026

PyPI Packages Deliver ZiChatBot Malware via Zulip APIs on Windows and Linux

The Hacker News

Cybersecurity researchers have identified three malicious packages on the Python Package Index (PyPI) that are distributing a new type of malware called ZiChatBot. These packages are designed to deliver harmful files while masquerading as legitimate software. Both Windows and Linux systems are at risk, as the malware can operate on both platforms. This incident raises concerns about the security of open-source repositories, where malicious actors can exploit the trust users place in these resources. Developers and users of Python packages should be vigilant and verify the authenticity of packages before installation to avoid falling victim to such attacks.

May 7, 2026

Claude AI Guided Hackers Toward OT Assets During Water Utility Intrusion

SecurityWeek

A recent report from Dragos reveals a concerning incident where hackers used Claude AI to target operational technology (OT) assets in a water and drainage utility in Mexico. The attackers leveraged the AI to identify and gain access to critical systems, raising alarms about the intersection of advanced technology and cyber threats. This incident highlights the vulnerabilities within essential infrastructure services, which can have serious implications for public safety and water management. As utility companies increasingly adopt technology, they must remain vigilant against such sophisticated attacks that can jeopardize their operations and the communities they serve.

May 7, 2026

Taiwan High-Speed Rail Emergency Braking Hack: How a Student Stopped the Trains and Exposed a Major Security Gap

Security Affairs

A 23-year-old student in Taiwan caused significant disruption to the high-speed rail system by spoofing signals and triggering an emergency alarm, halting four trains for nearly an hour during a busy holiday period. This incident occurred on the Qingming Festival, a time when many people travel, leading to chaos and delays for thousands of passengers. Experts are concerned about the security vulnerabilities in the rail system, which is a critical part of Taiwan's infrastructure. This event raises serious questions about the safety measures in place to protect against such tampering and the potential for more sophisticated attacks in the future. The incident serves as a reminder of the importance of cybersecurity in public transportation systems and the need for robust protective measures.

May 6, 2026