polyfill.io

Magecart’s 2024 Resurgence: Skimming in the Polyfill.io Aftermath

Post author:Prabhu Kalyan Samal
Post published:November 11, 2024
Post category:Identity & Phishing Security Supply Chain Security

Through 2024, digital skimming returned to threat reports' front pages: Magecart-style attacks compromised hundreds of storefronts via compromised third-party JavaScript, supply-chain infections like polyfill.io's June domain takeover injected malicious scripts into vast numbers of pages, and PCI DSS 4.0's script-integrity requirements (6.4.3 and 11.6.2) approached their March 2025 enforcement deadline. This survey digests the modern skimming kill chain — injection, exfiltration, and evasion — the major 2024 campaigns, and the compliance clock turning client-side risk into boardroom math.

Polyfill.io Hijack: 100,000+ Sites Inherited a Malicious Script

Post author:Prabhu Kalyan Samal
Post published:June 27, 2024
Post category:Security Supply Chain Security Web & API Security

When Sansec disclosed in late June 2024 that the polyfill.io domain had been sold and its hosted script rewritten to inject mobile-only scam redirects, hundreds of thousands of embedded sites — WordPress themes among them — discovered they had inherited an implant, invisible to desktop QA by design. This account traces the Funnull acquisition chain, the conditional payload mechanics, Cloudflare's mirror intervention, the DNS-harassment retaliation, the 2025 arrests, and the inventory lesson every site owner still owes themselves.