Vercel rolls out Device Bound Session Credentials (DBSC) against infostealer cookie theft and launches AI Security Review beta
Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 06/11/2026 06:01; os links antigos trazem para cá.
Fontes: securityonline.info ↗ helpnetsecurity.com ↗ bleepingcomputer.com ↗
Vercel has begun rolling out Device Bound Session Credentials (DBSC) to stop session hijacking by infostealer malware, and has launched Vercel Security Review in public beta (bleepingcomputer.com, helpnetsecurity.com). The rollout was announced by CTO Malte Ubl on 2026-11-04 (bleepingcomputer.com). DBSC binds a login session to the device that created it, so a stolen cookie cannot be replayed from another machine. This targets "pass-the-cookie" attacks by stealers such as Lumma, RedLine and Vidar, which take post-authentication cookies that bypass passwords and MFA (helpnetsecurity.com). Support is currently limited to Chrome on macOS and Windows, and the rollout is gradual (bleepingcomputer.com, helpnetsecurity.com, securityonline.info). Vercel is also deploying DPoP for its CLI. Bleepingcomputer.com recalls that Vercel suffered a breach in April 2026, which gives the announcement context.
Detalhes técnicos
- DBSC signs session cookies with a non-exportable private key held in hardware, so exfiltrated cookies cannot be reused even if malware extracts them from the browser (bleepingcomputer.com). It complements Chrome's App-Bound Encryption, which hardens cookie storage (bleepingcomputer.com).
- Cookies are short-lived and must be refreshed through proof of key possession. Stolen cookies therefore become useless once they expire (helpnetsecurity.com). Google standardized DBSC (securityonline.info).
- The rollout is staged to handle complexities such as OAuth app integrations. Vercel is developing a less-secure polyfill for broader browser support (helpnetsecurity.com, bleepingcomputer.com).
- Vercel is developing Demonstrating Proof-of-Possession (DPoP) for its CLI (helpnetsecurity.com, bleepingcomputer.com).
- Security Review, part of Vercel Agent, scans code pushed to connected GitHub repositories for issues such as missing authorization checks and exposed secrets (bleepingcomputer.com). It scans only code changed since the last deployment, traces reachability, and checks for existing mitigations before flagging issues. Findings appear as pull-request comments and in a security dashboard (helpnetsecurity.com). It can generate minimal fixes and tests, and can commit fixes when permitted (bleepingcomputer.com, helpnetsecurity.com).
- April 2026 breach: an employee's Google Workspace account at Context.ai was compromised, which exposed environment variables not marked sensitive. A threat actor impersonating ShinyHunters later tried to sell allegedly stolen source code, access keys and database data (bleepingcomputer.com). This is reported only by bleepingcomputer.com and is not linked to DBSC in the other sources.
Remediação
- Organizations using Vercel should enable DBSC where supported (Chrome on Mac/Windows) to reduce account takeover from infostealer infections (helpnetsecurity.com).
- Pro and Enterprise teams can enable Security Review. Scans are free until 2026-11-10 (helpnetsecurity.com, bleepingcomputer.com).
Relatos divergentes
- Key storage: bleepingcomputer.com mentions only the TPM. helpnetsecurity.com and securityonline.info also cite Apple Secure Enclave. The two later sources give the fuller picture, which fits macOS support.
Linha do tempo
-
Vercel DBSC Session Security Thwarts Cookie Theft
ler a análise desta fonte ocultar
Cloud development platform Vercel announced a vital defensive upgrade across its infrastructure. Specifically, the engineering team rolled out Vercel DBSC session security to protect developer accounts. This implementation binds active authentication sessions directly to cryptographic hardware keys residing on local devices. Consequently, adversaries cannot replay stolen cookies on secondary workstations to hijack accounts. Currently, the protection supports Google Chrome across Windows and macOS operating systems.
Infostealer malware routinely exfiltrates session cookies to bypass multi-factor authentication barriers. Subsequently, malicious actors import these hijacked tokens into remote browsers to impersonate developers. To eliminate this widespread attack vector, Google standardized Device Bound Session Credentials. This defensive mechanism relies on trusted platform modules or Apple Secure Enclave coprocessors.
-
Vercel Deploys Device Bound Session Credentials to Blunt Session-Hijacking via Infostealers, Adds AI Security Review
ler a análise desta fonte ocultar
Vercel has rolled out Device Bound Session Credentials (DBSC) and launched Vercel Security Review in public beta to reduce the impact of session hijacking and insecure code. DBSC cryptographically binds login sessions to the device that created them, mitigating "pass-the-cookie" attacks enabled by infostealers such as Lumma, RedLine, and Vidar, which steal post-authentication session cookies that bypass passwords and MFA. The technology relies on a hardware-backed public/private key pair (TPM or Secure Enclave) and short-lived cookies that must be continuously refreshed via proof of key possession, rendering stolen cookies useless once they expire. Separately, Vercel Security Review, part of Vercel Agent, is an AI-driven code scanner that reviews code changes pushed to GitHub for vulnerabilities, surfacing findings as pull-request comments and in a security dashboard.
Technical Details
DBSC is currently supported only by Chrome on Mac and Windows, with Vercel developing a less-secure polyfill for broader browser support. The rollout is gradual due to complexities such as OAuth app integrations. Vercel is also developing Demonstrating Proof-of-Possession (DPoP) for its CLI. Vercel Security Review scans only code changed since the last deployment, traces reachability of the changed code, and checks for existing mitigations before flagging issues; it can also auto-generate minimal fixes and tests.
Remediation
Organizations using Vercel should enable DBSC where supported (Chrome on Mac/Windows) to reduce exposure to cookie-theft-based account takeover from infostealer infections. Pro and Enterprise teams can enable Vercel Security Review, free until November 10, 2026, to catch vulnerabilities introduced via code pushes before deployment.
-
Vercel Deploys Device Bound Session Credentials to Block Stolen Cookie Reuse
ler a análise desta fonte ocultar
Vercel is rolling out Device Bound Session Credentials (DBSC) on its platform to counter infostealer malware that steals session cookies. Announced by CTO Malte Ubl, the feature binds login sessions to a device using a private key stored in the device's TPM, so a stolen cookie cannot be replayed on another machine. The rollout currently supports Chrome on macOS and Windows and is being staged gradually to handle OAuth edge cases. Vercel is also deploying DPoP for its CLI and has launched Security Review, a public beta feature in Vercel Agent that scans code pushed to connected GitHub repositories for issues like missing authorization checks and exposed secrets, with optional automated fixes.
Technical Details
DBSC signs session cookies with a non-exportable private key stored in the TPM, preventing reuse of exfiltrated cookies even if malware extracts them from the browser. This complements Chrome's App-Bound Encryption, which already hardens cookie storage against extraction. Security Review integrates into the CI/CD push workflow, applying code and team-defined policies to flag vulnerabilities, and can autonomously validate and commit fixes when permitted; scans are free until November 10, 2026.
The article also notes that in April 2026 Vercel suffered a breach after an employee's Google Workspace account at Context.ai was compromised, allowing attackers to view unmarked-sensitive environment variables; a threat actor impersonating ShinyHunters later attempted to sell the allegedly stolen source code, access keys, and database data.