Loading story…
Toshiba and Muji warned visitors that suspicious browser sign-in prompts appeared on their websites after residual references to polyfill[.]io began returning HTTP 401 authentication responses. The behavior caused browsers to display what looked like legitimate login dialogs, creating a risk that users could hand over credentials. Reports said the same issue also affected other Japanese organizations, including Zojirushi and FiNC Technologies, and was observed on some Samsung Smart TVs and related websites.
The incident is tied to the troubled polyfill[.]io domain, which was widely abused in 2024 after its acquisition by a Chinese entity led to malicious code being served to more than 100,000 websites. In the latest case, affected companies said they mitigated the problem by suspending use of the external service. No confirmed website compromise, unauthorized access, or credential theft has been reported, but users who entered passwords into the prompts were advised to change them as a precaution.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
The impacted companies said they addressed the problem by suspending use of the polyfill.io service. Reporting stated there was no confirmed website compromise, unauthorized access, or credential theft tied to the incident at the time of disclosure.
Toshiba and Muji warned visitors that suspicious browser sign-in prompts had appeared on their websites and could potentially capture credentials if users entered them. Other Japanese organizations, including Zojirushi and FiNC Technologies, were also reported as affected by the same issue.
In late May 2026, polyfill.io reportedly became active again and began returning HTTP 401 authentication responses, causing browsers to display sign-in prompts on affected websites. The behavior impacted sites that still had residual references to the service.
In 2024, the polyfill.io domain was reported as having been acquired by a Chinese entity and used to serve malicious code to more than 100,000 websites. This earlier abuse established the domain's prior association with web-based compromise activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A supply chain compromise of the widely used **Polyfill.io** JavaScript service exposed a vast number of websites after the `cdn.polyfill.io` domain began serving malicious code to visitors. Reporting from BleepingComputer, The Hacker News, Censys, and Italy’s CERT-AgID said the incident initially affected more than **100,000** sites and was later tied to over **380,000 hosts**, including major companies. The injected code redirected users to scam and fraudulent pages and created a risk of sensitive data theft, turning a trusted browser compatibility library into a large-scale web skimming and traffic hijacking vector. CERT-AgID urged public administrations to **immediately remove** all Polyfill.io references from their sites, warning that the service could no longer be trusted even after Namecheap suspended and reclaimed the malicious domain. The agency said it had already taken mitigation steps for affected public-sector entities and was removing the plugin from its own exposed systems. Security researchers also advised organizations to audit dependencies, replace Polyfill.io with safer alternatives or self-hosted code, and verify that no lingering references to the compromised service remain in production environments.
Jun 29, 2026
The `polyfill.io` CDN, embedded by more than 100,000 websites to deliver the Polyfill JavaScript library, was turned into a malware distribution channel after the domain and related GitHub account were reportedly acquired by a Chinese company. Researchers said the injected JavaScript selectively targeted visitors—especially mobile users—and redirected some of them to a sports betting site through spoofed analytics infrastructure. The malicious code also used anti-analysis techniques, including device checks, delayed execution, time-based activation, and logic to avoid triggering for administrators or when analytics tools were detected. The incident prompted broad mitigation efforts across the ecosystem. Cloudflare introduced real-time rewrites for `cdn.polyfill.io`, Namecheap later placed the domain on hold and then took it down, and Google began warning advertisers and blocking Google Ads for eCommerce sites still loading the compromised service. Security firms advised organizations to remove all `polyfill.io` references from source code because modern browsers generally no longer require the library; where compatibility support is still needed, they recommended replacing it with safer alternatives from providers such as Cloudflare or Fastly.
Jul 24, 2026
Multiple Japanese B2C e-commerce sites were compromised in a web skimming campaign that stole customers’ personal information, login credentials, and payment card data by injecting malicious JavaScript into checkout, login, and registration pages. Reporting from LAC linked the activity to techniques similar to **Water Pamola**, which Trend Micro and JPCERT/CC previously described as abusing malicious order submissions containing XSS payloads; when viewed in merchant administration panels, the payloads executed in administrators’ browsers, enabling credential theft, web shell deployment, and further compromise of the online store. The campaign affected sites built on **EC-CUBE** as well as other platforms, indicating the attackers were targeting exploitable e-commerce implementations rather than a single product. The skimming code evolved over time, including increased obfuscation and infrastructure changes from `googlevapis[.]com` to `jqueryapistatic[.]com`, while some incidents used the victim’s own domain as an HTTPS exfiltration endpoint to reduce detection. Investigators said the attackers harvested cardholder names, card numbers, expiration dates, security codes, email addresses, and passwords, and recommended patching platforms and plugins, restricting administrator access, enabling MFA, deploying WAF protections, and reviewing logs for connections to known malicious domains.
Aug 15, 2026