LONDON — DebugBear’s domain name system (DNS) records were compromised through its registrar on October 29, allowing attackers to serve malicious JavaScript via its Real User Monitoring (RUM) script to customer websites.
The incident enabled unauthorized transactions and potential data theft, posing a significant risk to other site owners utilizing DebugBear’s monitoring script, according to cybersecurity firms Hudson Rock and The Layman Security.
The malicious script specifically targeted users of the trading platform Polymarket, facilitating the sale of positions and the movement of funds from their cryptocurrency wallets, DebugBear reported.
Attackers exploited existing signed-in user sessions, eliminating the need for passwords to execute unauthorized actions, DebugBear said.
In response, DebugBear instructed its customers to immediately remove its Core Web Vitals monitoring script and to investigate their systems for any unauthorized access or changes.
Recommended actions for affected site owners include invalidating exposed user sessions, resetting passwords, revoking API credentials, and thoroughly checking for any unauthorized modifications or backdoors, according to security experts.
The compromise highlights the importance of supply chain security in web infrastructure, as a breach at one vendor can propagate malicious code across numerous client sites.
Source: Search Engine Journal
