Skip to navigation

Threat reportSupply ChainTL-2026-6044

nDiligence 'Attack the Glass' (ATG): Runtime Client-Side Rendering Supply-Chain Vulnerability Class Across 50 Platform Types

highMONITORING

nDiligence published a four-year study ('Attack the Glass', ATG) describing a vulnerability class in runtime client-side rendering: once code or assets from any compromised upstream supplier load into a running application, nothing verifies their behavior, so an attacker can alter displayed content, capture typed input and act with the user's authority.

Key facts

IdentifiersTL-2026-6044
Also known asAttack the Glass, ATG
SeverityHIGH
First disclosed
Affected productsMultiple Web-based and mobile applications using runtime client-side rendering; Multiple Device screens (vehicle displays, medical devices, industrial control screens); Polyfill.io (Funnull-controlled) cdn.polyfill.io polyfill service (cited precedent)
MalwareCSP
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1056 Input Capture, T1059.007 JavaScript, T1185 Browser Session Hijacking, T1195.002 Compromise Software Supply Chain, T1497.003 Time Based Checks, T1565.002 Transmitted Data Manipulation, T1583.001 Domains, T1608.004 Drive-by Target
MotivationUNKNOWN
Target sectorsgovernment administration, finance, health, energy, news - media, transport, critical-infrastructure
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6044 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-6044 Polyfill.io Injection Redirect Chain via Fake Analytics to Betting Landing — Post-Exploitation Phase

Correlates the multi-stage redirect chain Sansec documented for the Polyfill.io payload: polyfill script load, fake Google Analytics (googie-anaiytics.com ga.js), redirect hop on kuurza.com or newcrbpc.com (/redirect?from=), and the sports-betting landing w9.vty70.net. Two or more stages from one client within 15 minutes shows injected JavaScript executed in the browser (T1059.007) from a staged drive-by supplier (T1608.004). Mobile user-agent hits are counted because the payload targeted mobile devices.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1195.002, T1059.007, T1608.004
  • Data sources: proxy:zscalernss-web, proxy:pan:url, proxy:bluecoat:proxysg:access:syslog, CommonSecurityLog
  • Severity: high
  • Confidence: high

Splunk SPL

index=proxy (sourcetype="zscalernss-web" OR sourcetype="pan:url" OR sourcetype="bluecoat:proxysg:access:syslog") earliest=-24h
| eval dom=lower(coalesce(dest_host, url_domain, site, dest)), u=lower(url), ua=lower(coalesce(http_user_agent, useragent, ""))
| eval stage=case(match(dom,"(^|[.])(polyfill[.]io|polyfill[.]com)$") AND like(u,"%.js%"),"1_polyfill_script", match(dom,"(^|[.])googie-anaiytics[.]com$"),"2_fake_ga", match(dom,"(^|[.])(kuurza[.]com|newcrbpc[.]com)$") AND like(u,"%/redirect?from=%"),"3_redirect", match(dom,"(^|[.])vty70[.]net$"),"4_betting_landing")
| where isnotnull(stage)
| eval mobile_ua=if(match(ua,"android|iphone|ipad|mobile"),1,0)
| bin _time span=15m
| stats dc(stage) AS stages values(stage) AS stage_list values(dom) AS domains sum(mobile_ua) AS mobile_hits count BY src, user, _time
| where stages>=2

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend Host = tolower(coalesce(DestinationHostName, tostring(parse_url(RequestURL).Host))), Url = tolower(RequestURL)
| extend Stage = case(
    Host has_any ('polyfill.io','polyfill.com') and Url contains '.js', '1_polyfill_script',
    Host has 'googie-anaiytics.com', '2_fake_ga',
    Host has_any ('kuurza.com','newcrbpc.com') and Url contains '/redirect?from=', '3_redirect',
    Host has 'vty70.net', '4_betting_landing',
    '')
| where Stage != ''
| summarize Stages = dcount(Stage), StageList = make_set(Stage), Domains = make_set(Host), MobileHits = countif(RequestClientApplication matches regex '(?i)android|iphone|ipad|mobile') by SourceIP, SourceUserName, bin(TimeGenerated, 15m)
| where Stages >= 2

Sigma

title: Polyfill.io Injection Redirect Chain Hosts Contacted via Proxy
id: 0d9e4a77-85c2-4f63-b1a8-7c3e92f5d402
status: experimental
description: Detects single proxy events belonging to the Polyfill.io payload redirect chain (fake analytics script, redirect hop, betting landing). Correlate two or more within minutes per client in the SIEM (TL-2026-6044)
references:
    - https://sansec.io/research/polyfill-supply-chain-attack
    - https://thehackernews.com/2024/06/over-110000-websites-affected-by.html
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.execution
    - attack.t1059.007
    - attack.resource_development
    - attack.t1608.004
    - attack.initial_access
    - attack.t1195.002
logsource:
    category: proxy
detection:
    selection_fake_ga:
        cs-host|endswith: 'googie-anaiytics.com'
    selection_redirect:
        cs-host|endswith: ['kuurza.com', 'newcrbpc.com']
        c-uri|contains: '/redirect?from='
    selection_betting:
        cs-host|endswith: 'vty70.net'
    condition: 1 of selection_*
falsepositives:
    - Analysts or sandboxes replaying the chain
level: high

Known false positives:

  • Security analysts or automated sandboxes replaying the Polyfill.io redirect chain
  • Web-categorisation crawlers that fetch the listed domains

Tuning notes: Lower the stage threshold to 1 for a pure IOC alert or raise the window for slow chains. User-agent field names differ by proxy (http_user_agent, useragent, RequestClientApplication). The redirect probability varied by time of day in the original payload, so expect intermittent rather than constant hits.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • TL-2026-6044 Endpoint Network Connection to Polyfill.io / Funnull Infrastructure — Exploitation Phase · unlock with TL Creds
  • TL-2026-6044 CSP Violation Reports Showing Injected Script, Data-Capture or Exfil Destinations — Post-Exploitation Phase · unlock with TL Creds
  • TL-2026-6044 DNS Resolution of Polyfill.io Actor Domains and Analytics Typosquats — C2/Staging Phase · unlock with TL Creds
  • TL-2026-6044 Polyfill.io Payload URL Patterns — Fake Analytics Script, jQuery Masquerade, Redirect Parameter — Exploitation Phase · unlock with TL Creds
  • TL-2026-6044 Unapproved Third-Party JavaScript Loaded on Sensitive Pages (ATG Runtime Supplier Hunt) — Post-Exploitation Phase · unlock with TL Creds
  • TL-2026-6044 Web Requests to Funnull-Linked Sibling CDNs (bootcdn, bootcss, staticfile) — Staging/C2 Phase · unlock with TL Creds
  • TL-2026-6044 Web Proxy Contact with Polyfill.io / Funnull Supply-Chain Infrastructure — Exploitation Phase · unlock with TL Creds
  • TL-2026-6044 Injected Script Evasion Logic — Admin Cookie Gate, Analytics Delay, Mobile Gate in HTTP Responses — C2/Evasion Phase · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-6044.

Sample indicators (3 of 23)

  • Domain: cdn[.]polyfill[.]io
  • Domain: polyfill[.]com
  • Domain: polyfill[.]io[.]bsclink[.]cn

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

23 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

The study reports all 50 platform types examined are vulnerable and 46 are rated Critical or High; the 2024 Polyfill.io compromise is cited as a real-world example.

Attack the Glass (ATG) is a research-identified supply-chain injection vulnerability class in client-side rendering, announced by nDiligence, Inc. on 2026-11-12 (CyberNewswire press release) and led by Robert Beckett, Founder and CEO. Applications build their interface, load data and run code on the user's device at runtime, with content sourced from many suppliers: the organization's own systems, its vendors and their vendors. Compromising any one upstream supplier (data, media, components or code) gives an attacker a position inside the running application. Authentication, encryption, Zero Trust, firewalls and code review operate before the code loads; after loading, the code is trusted and its behavior is not checked. Per the ATG site, the resulting changes exist only in device memory, can target everyone, a group or one individual, and leave no forensic trace once the screen goes dark.

The study reports that 50 types of software and devices across 10 categories were examined and all were found vulnerable; 46 of 50 were rated Critical or High (ratings for the remaining four are not given in the sources). Five attacker effects are classified: deceive, disrupt, degrade, deny and destroy. Platform types named include web browsers, mobile apps, vehicle displays, medical devices and industrial control screens. Described abuse cases include disinformation inside legitimate news and election sites, false pictures shown to military commanders and infrastructure operators, hiding safety alerts from selected users, and demonstrations involving a bank payment, a medication record, a grid control display, an election results board and a trading desk. The attacker can alter what appears on screen, add content that was never there, remove content such as warnings, fees, alternatives or a 'no' button, and capture a decision and trigger the action (for example, send a payment). The ATG site states AI can generate a different deception for each target.

The cited real-world example is Polyfill.io. In February 2024 the polyfill.io domain and its GitHub account were acquired by the CDN company Funnull (reported by Sansec on 2024-06-25); more than 100,000 sites loaded the library from cdn.polyfill.io. The served JavaScript was generated dynamically from HTTP headers and, per Sansec, targeted mobile devices via a user-agent regex, redirected visitors through a fake Google Analytics domain to a sports-betting site, varied redirect probability by time of day, skipped execution when admin cookies (admin_id, adminlevels) were present, delayed execution by 2 seconds when common analytics scripts were detected, and included anti-reverse-engineering protections. Funnull and its administrator Liu Lizhi were sanctioned by OFAC on 2025-05-29 for facilitating pig-butchering scam infrastructure. The ATG authors state the underlying vulnerability was never fixed.

Important caveats: the primary source is a vendor press release and the vendor's own site; the whitepaper (16 chapters), 20 online demos and playbooks were not independently reviewed. No CVE is assigned (the ATG FAQ addresses why), no CVSS is published, no threat actor is attributed to ATG itself, and no active exploitation of ATG as a named campaign is claimed. The ATG site states there is no patch and no single solution; mitigation is risk reduction through remediation playbooks organized into three horizons (first ninety days, rest of first year, beyond). Material is licensed CC BY 4.0 and marked TLP:CLEAR. The IOCs in this record belong to the Polyfill.io precedent incident, not to ATG itself. The ATG study and press page also contain a header image apparently belonging to an unrelated product (a leftover asset).

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1497.003 Time Based Checks

Collection

T1056 Input Capture; T1185 Browser Session Hijacking

Execution

T1059.007 JavaScript

Initial Access

T1195.002 Compromise Software Supply Chain

Impact

T1565.002 Transmitted Data Manipulation

Resource Development

T1583.001 Domains; T1608.004 Drive-by Target

Remediation

Patches

  • No patch exists; the ATG site describes an endemic vulnerability class with no single fix and no CVE

Immediate actions

  • Inventory every runtime dependency (scripts, data feeds, media, components) loaded into client-side applications, including fourth-party suppliers
  • Remove references to cdn.polyfill.io and polyfill.com; use self-hosted copies or trusted mirrors (Cloudflare cdnjs polyfill, Fastly) if polyfills are still required
  • Search code bases and third-party integrations for the Polyfill.io-related IOCs listed in this record

Workarounds

  • Self-host and pin vetted third-party assets with Subresource Integrity where feasible (note: the ATG FAQ discusses the limits of HTTPS, CSP, SRI and Zero Trust against this class)

Longer-term hardening

  • Follow the nDiligence ATG remediation playbooks (first ninety days, rest of first year, beyond)
  • Monitor client-side script behavior and integrity in real time (e.g. CSP reporting, client-side script monitoring), not only at deploy time
  • Reduce the number of third-party suppliers whose code or data renders in security-critical screens (payments, medical records, control displays)
  • Add out-of-band confirmation of high-impact decisions (payments, safety-relevant actions) so the rendered screen is not the sole source of truth

Affected and fixed versions

  • Multiple — Web-based and mobile applications using runtime client-side rendering
    Vulnerable versions: All examined: 50 of 50 platform types
  • Multiple — Device screens (vehicle displays, medical devices, industrial control screens)
    Vulnerable versions: Categories named in the nDiligence study
  • Polyfill.io (Funnull-controlled) — cdn.polyfill.io polyfill service (cited precedent)
    Vulnerable versions: Served from the domain after Feb 2024 ownership change
    Fixed in: Remove or replace with Cloudflare/Fastly mirrors

Timeline

  • Per the ATG site, Robert Beckett recognized ATG as a vulnerability class and began the research (year only stated by source; day is a placeholder)
  • Polyfill.io domain and GitHub account acquired by CDN company Funnull (early February 2024; exact day not stated)
  • Sansec publishes research on malicious redirects served from locked-ioc-9 to mobile visitors across 100,000+ sites; Google begins blocking ads for affected e-commerce sites
  • Cloudflare begins rewriting locked-ioc-9 requests to its own mirror and Namecheap places the domain on hold
  • Sansec flags additional domains used by the same actor
  • OFAC sanctions Funnull Technology Inc. and administrator Liu Lizhi for facilitating pig-butchering scam infrastructure
  • nDiligence created to address supply-chain diligence, vetting and monitoring (month stated as January 2026; day is a placeholder)
  • nDiligence publicly releases the Attack the Glass study: 50 platform types examined, all vulnerable, 46 rated Critical or High; 16-chapter whitepaper, 20 demos and remediation playbooks (TLP:CLEAR)

Sources cited

Further reading

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats