{"success":true,"data":{"id":"vercel-agent-credit-topup-phish","label":"Fake Vercel compute credit depletion or spending limit exceeded notice to harvest payment credentials from non-vercel.com sender","description":"Fake Vercel compute credit depletion or spending limit exceeded notice directing victims to update payment credentials. Vercel hosts millions of web applications including AI-powered apps that consume significant compute credits for edge functions and AI inference. As agentic workflows deploy on Vercel, \"compute credits exhausted — deployments paused\" is a plausible and urgent scenario. Attackers send fake \"Your Vercel compute credits have been exhausted by your AI agent workflows — all deployments are paused — add a payment method to resume\" or \"Vercel spending limit exceeded — AI functions and edge deployments are disabled\" emails. Victims who click are taken to a phishing page harvesting Vercel login credentials or payment card data. A compromised Vercel account gives the attacker access to environment variables (API keys, database URLs, secrets) for all deployed projects. The signal fires when: (1) body references Vercel brand AND (2) compute credit depletion, spending limit, deployments paused, or add payment method urgency is present AND (3) sender is NOT vercel.com AND (4) no List-Unsubscribe or In-Reply-To. Source: GC1 R14 council #8; Vercel security advisory 2026.","tier":"danger","category":"phishing","isThin":false}}