Funnull Polyfill supply chain attack (Campaign)
ID: 399d4bd6-879a-53a2-ac1d-491a61c890ee
STIX ID: report--399d4bd6-879a-53a2-ac1d-491a61c890ee
Feed Name: Wiz Cloud Threat Landscape
Threat Score
Date Published: 2024-06-25
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
...
...
Funnull Polyfill supply chain attack: A Chinese company named Funnull acquired the Polyfill domain and GitHub repository and injected malware into polyfill.js to redirect users to gambling sites; pivoting revealed an exposed Cloudflare API key that connected Funnull to several CDN providers also distributing malicious scripts, indicating a supply-chain/insider compromise of widely used web assets.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.