Search — “C7xcKKrjUnXK.js”
1 story · 2 IoCs
Stories
P1
Polymarket users' sessions targeted by malicious JavaScript served via compromised DebugBear RUM script; attack under investigation
Polymarket temporarily halted trading after a third-party provider was compromised and malicious JavaScript was distributed from cdn.debugbear[.]com, which BleepingComputer says was designed to hijack logged-in Polymarket trading sessions and move users' prediction-market tokens and crypto to an attacker wallet. Polymarket says it fixed the issue and will reimburse affected traders, but has not disclosed the number of victims or amount stolen; a ~$2.5M figure is traced to the attacker wallet, not confirmed as user losses. Hunters on DebugBear RUM embed code should look for requests to cdn.debugbear[.]com/C7xcKKrjUnXK.js and outbound traffic to data.debugbear.com.
IoCs
| filename | C7xcKKrjUnXK.js | seen 1×, first 2026-10-30 12:20Z | Malicious JavaScript file name on the DebugBear CDN. · 2026-10-30 |
| url | hxxp://cdn[.]debugbear[.]com/C7xcKKrjUnXK[.]js | seen 1×, first 2026-10-30 12:20Z | Malicious JavaScript distributed to Polymarket users via DebugBear RUM infrastructure. · 2026-10-30 |