MENA Cyber Wire
Threat Intelligence

The Polyfill.io Crisis: Is Your Website Unknowingly Serving Malware?

A massive supply chain attack via the Polyfill.io service has compromised over 100,000 websites, forcing global security teams to scramble for mitigation strategies and alternative CDNs.

Omar Al-Hakeem
Senior Cyber Threat Analyst | MENA Region••2 min read
Polyfill.io supply chain attack spreading malware across thousands of websites

Polyfill.io supply chain attack spreading malware across thousands of websites

The global cybersecurity community is currently confronting one of the most significant supply chain attacks of the year following the compromise of the Polyfill.io domain. This service, which provides essential scripts for cross-browser compatibility, was acquired by a new entity earlier this year, leading to the deployment of malicious code across a vast ecosystem of websites. This incident underscores the inherent risks of relying on third-party infrastructure without rigorous oversight.

Anatomy of a Domain Hijack

In early 2024, the Polyfill.io domain was sold to a Chinese organization named Funnull. Following this transition, security researchers began detecting suspicious activity. The service started injecting obfuscated JavaScript into web applications that loaded the polyfill library directly from the original CDN. The malicious code is specifically designed to redirect mobile users to gambling and phishing sites, often employing sophisticated techniques to evade detection by security researchers and automated scanners.

100,000+Estimated number of websites identified as being affected by the malicious Polyfill.io scripts, including major global platforms.

Technical Evasion and Targeted Delivery

The attack stands out for its selective delivery mechanism. The malicious payload is not served to every visitor. Instead, it checks for specific headers and environmental conditions, often remaining dormant if it detects a developer console is open or if the request originates from a known security scanning IP range. This level of sophistication suggests a deliberate effort to prolong the campaign's lifespan while harvesting as much traffic as possible.

"This breach is a masterclass in supply chain vulnerability. It proves that even the most trusted, 'set-it-and-forget-it' utilities can become high-velocity delivery vehicles for malware overnight."
— Security Research Perspective

Global Response and Remediation

Major infrastructure providers have moved rapidly to neutralize the threat. Cloudflare and Fastly have both launched mirror services to provide safe, clean versions of the polyfill library, allowing developers to switch their endpoints without breaking site functionality. Organizations are urged to audit their codebases immediately and replace any references to the compromised domain. Detailed technical analysis of the injected code can be reviewed through Sansec's threat report.

  • Audit all external script dependencies and identify calls to cdn.polyfill.io.
  • Transition to trusted alternatives such as the Cloudflare or Fastly mirrors.
  • Implement Subresource Integrity (SRI) hashes to ensure that scripts have not been tampered with.
  • Adopt Content Security Policies (CSP) to restrict where scripts can be loaded from.

The Strategic Shift

Supply chain security is no longer just about software packages like NPM or PyPI. It extends to the very domains and CDNs that serve the web. This incident highlights why zero-trust principles must be applied to third-party front-end assets.

Long-term Implications for Web Development

As the industry moves forward, this event will likely trigger a broader movement away from public CDNs for critical libraries. More organizations are expected to begin self-hosting dependencies or utilizing more secure, audited repositories. For more information on securing web assets, the CISA supply chain guidance provides a framework for identifying these types of dependencies.

Omar Al-Hakeem

Senior Cyber Threat Analyst | MENA Region

Omar Al-Hakeem is a cybersecurity researcher specializing in threat intelligence, ransomware trends, and nation-state activity across the Middle East and North Africa. With over 12 years of experience in SOC operations and incident response, he provides deep technical breakdowns of emerging attacks and regional cyber risks. At MENA Cyber Wire, Omar focuses on real-world threat analysis and actionable defense strategies for enterprises and startups.