# nDiligence 'Attack the Glass' (ATG): Runtime Client-Side Rendering Supply-Chain Vulnerability Class Across 50 Platform Types

> nDiligence published a four-year study ('Attack the Glass', ATG) describing a vulnerability class in runtime client-side rendering: once code or assets from any compromised upstream supplier load into a running application, nothing verifies their behavior, so an attacker can alter displayed content, capture typed input and act with the user's authority. The study reports all 50 platform types examined are vulnerable and 46 are rated Critical or High; the 2024 Polyfill.io compromise is cited as a real-world example.

- **Published:** 2026-11-14T05:53:13Z
- **Last reviewed:** 2026-11-14T05:53:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6044
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6044.png
- **ID:** TL-2026-6044
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (3 shown free below)

## Description

Attack the Glass (ATG) is a research-identified supply-chain injection vulnerability class in client-side rendering, announced by nDiligence, Inc. on 2026-11-12 (CyberNewswire press release) and led by Robert Beckett, Founder and CEO. Applications build their interface, load data and run code on the user's device at runtime, with content sourced from many suppliers: the organization's own systems, its vendors and their vendors. Compromising any one upstream supplier (data, media, components or code) gives an attacker a position inside the running application. Authentication, encryption, Zero Trust, firewalls and code review operate before the code loads; after loading, the code is trusted and its behavior is not checked. Per the ATG site, the resulting changes exist only in device memory, can target everyone, a group or one individual, and leave no forensic trace once the screen goes dark.

The study reports that 50 types of software and devices across 10 categories were examined and all were found vulnerable; 46 of 50 were rated Critical or High (ratings for the remaining four are not given in the sources). Five attacker effects are classified: deceive, disrupt, degrade, deny and destroy. Platform types named include web browsers, mobile apps, vehicle displays, medical devices and industrial control screens. Described abuse cases include disinformation inside legitimate news and election sites, false pictures shown to military commanders and infrastructure operators, hiding safety alerts from selected users, and demonstrations involving a bank payment, a medication record, a grid control display, an election results board and a trading desk. The attacker can alter what appears on screen, add content that was never there, remove content such as warnings, fees, alternatives or a 'no' button, and capture a decision and trigger the action (for example, send a payment). The ATG site states AI can generate a different deception for each target.

The cited real-world example is Polyfill.io. In February 2024 the polyfill.io domain and its GitHub account were acquired by the CDN company Funnull (reported by Sansec on 2024-06-25); more than 100,000 sites loaded the library from cdn.polyfill.io. The served JavaScript was generated dynamically from HTTP headers and, per Sansec, targeted mobile devices via a user-agent regex, redirected visitors through a fake Google Analytics domain to a sports-betting site, varied redirect probability by time of day, skipped execution when admin cookies (admin_id, adminlevels) were present, delayed execution by 2 seconds when common analytics scripts were detected, and included anti-reverse-engineering protections. Funnull and its administrator Liu Lizhi were sanctioned by OFAC on 2025-05-29 for facilitating pig-butchering scam infrastructure. The ATG authors state the underlying vulnerability was never fixed.

Important caveats: the primary source is a vendor press release and the vendor's own site; the whitepaper (16 chapters), 20 online demos and playbooks were not independently reviewed. No CVE is assigned (the ATG FAQ addresses why), no CVSS is published, no threat actor is attributed to ATG itself, and no active exploitation of ATG as a named campaign is claimed. The ATG site states there is no patch and no single solution; mitigation is risk reduction through remediation playbooks organized into three horizons (first ninety days, rest of first year, beyond). Material is licensed CC BY 4.0 and marked TLP:CLEAR. The IOCs in this record belong to the Polyfill.io precedent incident, not to ATG itself. The ATG study and press page also contain a header image apparently belonging to an unrelated product (a leftover asset).

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1583.001 Domains
- T1608.004 Drive-by Target
- T1027 Obfuscated Files or Information
- T1497.003 Time Based Checks
- T1185 Browser Session Hijacking
- T1056 Input Capture
- T1565.002 Transmitted Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-6044 Polyfill.io Injection Redirect Chain via Fake Analytics to Betting Landing — Post-Exploitation Phase** (`TL-2026-6044-SPL-002`)

Correlates the multi-stage redirect chain Sansec documented for the Polyfill.io payload: polyfill script load, fake Google Analytics (googie-anaiytics.com ga.js), redirect hop on kuurza.com or newcrbpc.com (/redirect?from=), and the sports-betting landing w9.vty70.net. Two or more stages from one client within 15 minutes shows injected JavaScript executed in the browser (T1059.007) from a staged drive-by supplier (T1608.004). Mobile user-agent hits are counted because the payload targeted mobile devices.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1059.007, T1608.004
- **Data sources:** proxy:zscalernss-web, proxy:pan:url, proxy:bluecoat:proxysg:access:syslog, CommonSecurityLog
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy (sourcetype="zscalernss-web" OR sourcetype="pan:url" OR sourcetype="bluecoat:proxysg:access:syslog") earliest=-24h
| eval dom=lower(coalesce(dest_host, url_domain, site, dest)), u=lower(url), ua=lower(coalesce(http_user_agent, useragent, ""))
| eval stage=case(match(dom,"(^|[.])(polyfill[.]io|polyfill[.]com)$") AND like(u,"%.js%"),"1_polyfill_script", match(dom,"(^|[.])googie-anaiytics[.]com$"),"2_fake_ga", match(dom,"(^|[.])(kuurza[.]com|newcrbpc[.]com)$") AND like(u,"%/redirect?from=%"),"3_redirect", match(dom,"(^|[.])vty70[.]net$"),"4_betting_landing")
| where isnotnull(stage)
| eval mobile_ua=if(match(ua,"android|iphone|ipad|mobile"),1,0)
| bin _time span=15m
| stats dc(stage) AS stages values(stage) AS stage_list values(dom) AS domains sum(mobile_ua) AS mobile_hits count BY src, user, _time
| where stages>=2
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend Host = tolower(coalesce(DestinationHostName, tostring(parse_url(RequestURL).Host))), Url = tolower(RequestURL)
| extend Stage = case(
    Host has_any ('polyfill.io','polyfill.com') and Url contains '.js', '1_polyfill_script',
    Host has 'googie-anaiytics.com', '2_fake_ga',
    Host has_any ('kuurza.com','newcrbpc.com') and Url contains '/redirect?from=', '3_redirect',
    Host has 'vty70.net', '4_betting_landing',
    '')
| where Stage != ''
| summarize Stages = dcount(Stage), StageList = make_set(Stage), Domains = make_set(Host), MobileHits = countif(RequestClientApplication matches regex '(?i)android|iphone|ipad|mobile') by SourceIP, SourceUserName, bin(TimeGenerated, 15m)
| where Stages >= 2
```

### Sigma

```yaml
title: Polyfill.io Injection Redirect Chain Hosts Contacted via Proxy
id: 0d9e4a77-85c2-4f63-b1a8-7c3e92f5d402
status: experimental
description: Detects single proxy events belonging to the Polyfill.io payload redirect chain (fake analytics script, redirect hop, betting landing). Correlate two or more within minutes per client in the SIEM (TL-2026-6044)
references:
    - https://sansec.io/research/polyfill-supply-chain-attack
    - https://thehackernews.com/2024/06/over-110000-websites-affected-by.html
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.execution
    - attack.t1059.007
    - attack.resource_development
    - attack.t1608.004
    - attack.initial_access
    - attack.t1195.002
logsource:
    category: proxy
detection:
    selection_fake_ga:
        cs-host|endswith: 'googie-anaiytics.com'
    selection_redirect:
        cs-host|endswith: ['kuurza.com', 'newcrbpc.com']
        c-uri|contains: '/redirect?from='
    selection_betting:
        cs-host|endswith: 'vty70.net'
    condition: 1 of selection_*
falsepositives:
    - Analysts or sandboxes replaying the chain
level: high
```

**Known false positives:**

- Security analysts or automated sandboxes replaying the Polyfill.io redirect chain
- Web-categorisation crawlers that fetch the listed domains

**Tuning notes:** Lower the stage threshold to 1 for a pure IOC alert or raise the window for slow chains. User-agent field names differ by proxy (http_user_agent, useragent, RequestClientApplication). The redirect probability varied by time of day in the original payload, so expect intermittent rather than constant hits.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-6044 Endpoint Network Connection to Polyfill.io / Funnull Infrastructure — Exploitation Phase (locked: unlock with TL Creds)
- TL-2026-6044 CSP Violation Reports Showing Injected Script, Data-Capture or Exfil Destinations — Post-Exploitation Phase (locked: unlock with TL Creds)
- TL-2026-6044 DNS Resolution of Polyfill.io Actor Domains and Analytics Typosquats — C2/Staging Phase (locked: unlock with TL Creds)
- TL-2026-6044 Polyfill.io Payload URL Patterns — Fake Analytics Script, jQuery Masquerade, Redirect Parameter — Exploitation Phase (locked: unlock with TL Creds)
- TL-2026-6044 Unapproved Third-Party JavaScript Loaded on Sensitive Pages (ATG Runtime Supplier Hunt) — Post-Exploitation Phase (locked: unlock with TL Creds)
- TL-2026-6044 Web Requests to Funnull-Linked Sibling CDNs (bootcdn, bootcss, staticfile) — Staging/C2 Phase (locked: unlock with TL Creds)
- TL-2026-6044 Web Proxy Contact with Polyfill.io / Funnull Supply-Chain Infrastructure — Exploitation Phase (locked: unlock with TL Creds)
- TL-2026-6044 Injected Script Evasion Logic — Admin Cookie Gate, Analytics Delay, Mobile Gate in HTTP Responses — C2/Evasion Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 23)

Defanged, TLP:CLEAR.

- Domain: `cdn[.]polyfill[.]io`
- Domain: `polyfill[.]com`
- Domain: `polyfill[.]io[.]bsclink[.]cn`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [nDiligence Releases Four-Year Study Identifying a Critical Supply-Chain Vulnerability Across 50 Platform Types](https://cybersecuritynews.com/ndiligence-releases-four-year-study-identifying-a-critical-supply-chain-vulnerability-across-50-platform-types/)
- [Attack the Glass (ATG) - nDiligence research site](https://atg.ndiligence.com/)
- [nDiligence company site](https://www.ndiligence.com/)
- [Sansec: Polyfill supply chain attack embeds malware in JavaScript CDN assets](https://sansec.io/research/polyfill-supply-chain-attack)
- [The Hacker News: Over 110,000 Websites Affected by Hijacked Polyfill.io Supply Chain Attack](https://thehackernews.com/2024/06/over-110000-websites-affected-by.html)
- [U.S. Treasury press release sb0149: OFAC sanctions Funnull Technology Inc. and Liu Lizhi](https://home.treasury.gov/news/press-releases/sb0149)
- [Elliptic: OFAC sanctions cloud infrastructure provider linked to pig butchering scams](https://www.elliptic.co/blog/ofac-sanctions-cloud-infrastructure-provider-linked-to-pig-butchering-scams)
- [c/side: More than 100k websites targeted in web supply chain attack](https://cside.com/blog/more-than-100k-websites-targeted-in-web-supply-chain-attack)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6044