Visitors to Toshiba and Muji's websites were recently greeted by fraudulent sign-in overlays designed to steal login credentials — a direct consequence of the ongoing Polyfill.io supply chain compromise that continues to ensnare organisations well over a year after it was first publicly disclosed.
According to a BleepingComputer report, the Japanese electronics manufacturer and the global retail chain both displayed suspicious authentication prompts on their web properties. The fake login screens were generated by malicious JavaScript code served from the compromised polyfill[.]io domain, which has been weaponised since its acquisition by Chinese-registered firm Funnull in early 2024.
Neither Toshiba nor Muji has disclosed how many visitors may have been exposed or whether any credentials were successfully stolen before the issue was identified.
A supply chain attack with a long tail
The Polyfill.io saga has become one of the most consequential JavaScript supply chain incidents in recent memory. The original polyfill[.]io service was a widely trusted content delivery network that provided JavaScript polyfills — code snippets enabling older browsers to support modern web features. Millions of websites incorporated it via a simple <script> tag.
When Funnull acquired the domain in early 2024, researchers began observing malicious redirects and injected payloads. The community response was swift: Cloudflare and Fastly launched alternative endpoints, and security advisories urged developers to purge all references to polyfill[.]io. Google also blocked ads pointing to the compromised domain.
Yet the Toshiba and Muji incidents demonstrate that disclosure alone does not equal remediation. Organisations that failed to audit their third-party script dependencies — or that rely on legacy codebases with outdated template files — remain vulnerable to code that loads dynamically at runtime from a domain they may no longer actively monitor.
Fake login overlays mark an escalation
What makes the latest wave of activity notable is the shift in payload. Earlier Polyfill.io abuse primarily involved redirects to scam pages and gambling sites. The credential-harvesting overlay technique observed on the Toshiba and Muji sites represents a more targeted and financially motivated approach — one that directly exploits user trust in a recognisable brand to capture sensitive account information.
Because the malicious code originates from what the browser treats as a first-party page load via a CDN, traditional perimeter defences such as firewalls and network-level content filtering offer little protection. The script executes within the context of the legitimate website, making detection difficult without specialised browser-level or endpoint monitoring.
Lessons for developers and security teams
The incident underscores several concrete steps that development and security teams should be taking:
- Audit all third-party script references, including those embedded in templates, tag managers, and legacy code that may not be part of regular dependency reviews.
- Implement Subresource Integrity (SRI) hashes on all externally loaded scripts. SRI ensures a script will not execute if its contents have been altered at the source, providing a critical safeguard against CDN-level tampering.
- Deploy Content Security Policy (CSP) headers that restrict which domains are permitted to serve executable JavaScript, reducing the blast radius of any single compromised dependency.
- Maintain a client-side Software Bill of Materials (SBOM) that tracks all third-party dependencies, enabling rapid response when a service is compromised.
The Polyfill.io compromise is a stark reminder that in modern web development, trust in a third-party domain is not a static asset. Services change hands, domains get repurposed, and the scripts your users' browsers execute today may behave very differently tomorrow. Continuous vigilance — not one-time fixes — is the only reliable defence against supply chain attacks that refuse to die.
近期造訪東芝與無印良品網站的用戶，遭遇了旨在竊取登入憑證的欺詐性登入覆蓋層——這是持續一年以上、至今仍不斷波及各機構的Polyfill.io供應鏈漏洞事件直接導致的後果。
據BleepingComputer報導，這家日本電子製造商與全球零售連鎖企業在其網站上均出現了可疑的驗證提示。這些偽造的登入介面，是由來自遭入侵的polyfill[.]io域名所傳送的惡意JavaScript程式碼所產生；該域名自2024年初被中國註冊公司Funnull收購後，已被武器化利用。
東芝和無印良品均未透露有多少訪客可能暴露於風險中，以及在問題被發現前是否有任何憑證被成功盜取。
持續蔓延的供應鏈攻擊
Polyfill.io事件已成為近年最具影響力的JavaScript供應鏈事故之一。原始的polyfill[.]io服務是一個廣受信賴的內容分發網絡，提供JavaScript的polyfill程式碼——這些程式碼片段能使舊版瀏覽器支援現代網頁功能。數以百萬計的網站透過簡單的<script>標籤將其納入。
當Funnull於2024年初收購該域名後，研究人員開始觀察到惡意重新導向和注入的攻擊載荷。業界的反應迅速：Cloudflare和Fastly推出了替代端點，安全公告敦促開發者清除所有對polyfill[.]io的引用。Google亦封鎖了指向該受損域名的廣告。
然而，東芝和無印良品的事件表明，僅僅披露漏洞並不等同於修復。那些未能審核其第三方腳本依賴項——或依賴於包含過時模板檔案的舊有程式碼庫——的機構，仍然容易受到在運行時從其可能不再主動監控的域名動態載入的程式碼的攻擊。
偽造登入覆蓋層標誌著事態升級
最新一波活動的顯著之處在於攻擊載荷的轉變。早期的Polyfill.io濫用主要涉及重新導向至詐騙頁面和賭博網站。在東芝和無印良品網站上觀察到的憑證竊取覆蓋層技術，代表了一種更具針對性、更以經濟利益為動機的攻擊方式——它直接利用使用者對知名品牌的信任，以獲取敏感的帳戶資訊。
由於惡意程式碼源自瀏覽器視為透過CDN進行的第一方頁面載入，傳統的周邊防禦措施（如防火牆和網路層級的內容過濾）提供的保護有限。該腳本在合法網站的上下文中執行，若無專門的瀏覽器層級或端點監控，偵測將十分困難。
開發與安全團隊的啟示
此事件突顯了開發和安全團隊應採取的若干具體步驟：
- 審核所有第三方腳本引用，包括那些嵌入在模板、標籤管理器以及可能未納入常規依賴項審查的舊有程式碼中的引用。
- 對所有外部載入的腳本實施子資源完整性（SRI）雜湊值。SRI確保若腳本內容在來源處被篡改，腳本將不會執行，從而提供針對CDN層級篡改的關鍵防護。
- 部署內容安全策略（CSP）標頭，限制允許哪些域名提供可執行的JavaScript，從而減少任何單一受損依賴項的爆炸半徑。
- 維護客戶端的軟件物料清單（SBOM），追蹤所有第三方依賴項，以便在某項服務受損時能迅速響應。
Polyfill.io漏洞事件嚴酷地提醒我們，在現代網頁開發中，對第三方域名的信任並非一成不變。服務可能易主，域名可能被挪作他用，而今日您使用者瀏覽器執行的腳本，明日的行為可能迥然不同。唯有持續保持警惕——而非一次性修補——才是對抗那些揮之不去的供應鏈攻擊的可靠防禦之道。