Digging into the Web of Compromised Domains

**Executive Summary:** On June 25–27, 2024 researchers disclosed a supply-chain attack in which the Polyfill.io CDN and GitHub account were acquired and used to serve malicious, evasive JavaScript that redirected users and deployed malware; Namecheap later suspended the malicious polyfill.io domain but Censys observed hundreds of thousands of hosts still referencing the compromised endpoints and identified four additional potentially-associated domains (bootcdn.net, bootcss.com, staticfile.net, staticfile.org), with evidence of active abuse and widespread exposure across major sites and hosting providers.