Massive Supply-Chain Attack Affects Over 384,000 Websites, Including Major Brands and Government Sites

Massive Supply-Chain Attack Affects Over 384,000 Websites, Including Major Brands and Government Sites

Researchers reported that over 384,000 websites are linked to a site recently involved in a supply-chain attack, which redirected visitors to malicious sites. This site, polyfill[.]com, had been a legitimate open-source project for years, helping older browsers handle advanced functions. Websites embedded a link to cdn.polyfill[.]io to render content in newer formats.

In February, China-based Funnull acquired the domain and GitHub account hosting the JavaScript code. On June 25, security firm Sansec revealed that the code had been altered to redirect users to adult and gambling sites. The malicious code was designed to mask redirections by targeting visitors at specific times and under certain conditions.

The discovery led to swift actions across the industry. Domain registrar Namecheap suspended the domain, stopping the malicious code. Content delivery networks like Cloudflare began replacing polyfill links with safe mirror sites. Google blocked ads for sites using the Polyfill[.]io domain, and uBlock Origin added the domain to its filter list. Andrew Betts, the original creator of Polyfill.io, advised website owners to remove links to the library immediately.

As of one week after the attack was discovered, 384,773 sites were still linking to polyfill[.]com, including those associated with major companies like Hulu, Mercedes-Benz, Warner Bros., and the US federal government. This highlights the significant impact of supply-chain attacks, which can spread malware to numerous users by compromising a common source.

The Censys Research Team found that the attack was halted after the domain suspension. However, they warned that if the domain were reactivated, the malicious behavior could resume. Censys also identified over 1.6 million sites linking to domains owned by the same entity as polyfill[.]io, with some performing similar malicious actions.

Among the 384,773 sites still linking to polyfill[.]com, nearly 62 percent were hosted by Germany-based Hetzner. Major sites, including those from Warner Bros., Hulu, and Mercedes-Benz, were affected. Additionally, Censys found 182 government-affiliated domains still linked to the compromised site.

Attempts to reach Funnull for comment were unsuccessful.