Attackers compromised a third-party performance monitoring script from DebugBear to inject malicious code into Polymarket, resulting in the unauthorized sale of user positions and theft of funds.
// analyst note
This incident highlights the persistent risk of third-party supply chain attacks via frontend dependencies. FinTech and crypto platforms should implement strict Content Security Policy (CSP) headers and Subresource Integrity (SRI) hashes. Defenders must audit all external scripts loaded into authenticated user sessions.
Curated by 90@! Ltd from The Hacker News. Read the original for full technical detail.
Read original at The Hacker News// 90@! Ltd
90@! Ltd is a UK applications and cybersecurity consultancy. We help teams triage, remediate, and harden against emerging threats like this one.
Start an engagement