On October 29, Search Engine Journal reports that hackers launched a DebugBear DNS breach by hijacking the company's DNS records through its domain registrar. The attack deployed malicious JavaScript via DebugBear's Real User Monitoring script, forcing site owners to remove the code immediately and investigate potential unauthorized access.
Key takeaways
- DebugBear instructed customers to remove its Core Web Vitals monitoring script after a security incident.
- Cybersecurity firm Hudson Rock found malicious code at a DebugBear script URL used by Polymarket on October 29.
- Polymarket confirmed that the script sold positions and moved funds from user wallets.
- Site owners must check exposed accounts, invalidate sessions, and investigate unauthorized changes.
How did the DebugBear DNS breach happen?
According to Search Engine Journal, attackers compromised DebugBear DNS records via its domain registrar to serve malicious JavaScript. DebugBear stated in an update that its initial investigation pointed to one customer website being targeted, with no signs that its internal systems were compromised.
During the incident, DebugBear could not receive email sent to its domain. Hudson Rock discovered the malicious payload at a script URL used by Polymarket on October 29, which targeted the trading client already present in a logged-in browser without needing user passwords.
What site owners using the Real user Monitoring script should do
Development and security teams must remove the embed immediately from templates, plugins, and tag managers. Teams need to invalidate exposed sessions, reset administrator passwords, and revoke API credentials.
Sites should check for unauthorized changes, review account creation logs, and put compromised sites into maintenance mode with an HTTP 503 response if needed.
What it means for website security
This incident shows how third-party script vulnerabilities can be exploited to target high-value platforms and users who are already signed in. While removing the tag stops new loads, it does not reverse actions already taken by attackers, meaning teams must thoroughly audit logs and isolate affected environments.
Frequently asked questions
Attackers compromised DebugBear DNS records through its domain registrar, which allowed them to serve malicious JavaScript via the company's Real User Monitoring script.
DebugBear instructed customers to remove its Core Web Vitals monitoring script on October 29 after discovering the security incident involving its infrastructure.
Polymarket was affected, with an incident report confirming that the injected script sold trading positions and moved funds from some users' wallets.
No, the code used the access of a signed-in visitor who was already logged into their browser and did not require the user's password.
Site owners should invalidate exposed sessions, reset passwords for privileged users, check for unauthorized account changes, review system logs, and put compromised sites into maintenance mode.
Based on reporting by Search Engine Journal. Read the original article
