Malicious script served from DebugBear RUM CDN targeted Polymarket trading sessions; trading halted
A malicious script served from DebugBear's RUM CDN was designed to hijack logged-in Polymarket sessions and move funds to an attacker wallet. Today, check whether any of your websites embed DebugBear RUM and remove the embed if so, then hunt proxy and DNS logs for the script path and data.debugbear.com.
Triage: A third-party monitoring script was reported serving session-hijacking code to logged-in users, and any site embedding DebugBear RUM serves that vendor's code to its visitors [S1].
Two reputable secondary outlets report it. No DebugBear or Polymarket primary advisory is in the sources, and loss figures differ and are unconfirmed.
What happened
- A third-party provider was compromised, and malicious JavaScript was distributed from cdn.debugbear[.]com/C7xcKKrjUnXK.js [S1]
- BleepingComputer says the script was designed to hijack authenticated Polymarket trading sessions and move users' tokens and crypto to an attacker wallet [S1]
- The script communicated with data.debugbear.com to receive instructions and send data about targeted accounts [S1]
- Polymarket halted trading, says it fixed the issue, and will reimburse affected traders. It has not disclosed victim count or amount stolen [S1]
- About $2.5M is traced to the attacker wallet, which is not confirmed as user losses. SecurityWeek headlines $2 million drained [S1][S2]
- DebugBear advised customers to remove the RUM embed code [S1]
Timeline
| 2026-10-30 | Public reporting of the compromise, the Polymarket trading halt and funds traced to the attacker wallet S1 |
| 2026-10-30 | SecurityWeek reports about $2 million drained in a supply-chain attack S2 |
Detect
Malicious DebugBear script fetched · Web proxy / secure web gateway logs
index=* url="*cdn.debugbear.com/C7xcKKrjUnXK.js*" | stats count min(_time) as first max(_time) as last values(http_referrer) as referrer by src, user, url
A hit means: A browser on your network loaded the malicious script. The referrer shows which site embedded it. If the referrer is your own site, your visitors were served it.
Contact with data.debugbear.com · DNS logs; web proxy logs
index=* (query="data.debugbear.com" OR dest="data.debugbear.com" OR url="*data.debugbear.com*") | stats count min(_time) as first max(_time) as last values(http_referrer) as referrer by src, user
A hit means: A host talked to the reported instruction and exfil host. Corroborate it with a fetch of the malicious script from the same host before treating it as malicious.
Sites referencing DebugBear CDN · Web proxy logs
index=* url="*cdn.debugbear.com*" | stats count dc(src) as clients values(url) as urls by http_referrer
A hit means: Lists the sites, including any of your own, that pull scripts from the DebugBear CDN. These are your exposure inventory leads, not proof of compromise.
Verify
- Confirm the requested path is exactly /C7xcKKrjUnXK.js on cdn.debugbear.com [S1]
- Check the referrer. A Polymarket referrer matches the reported campaign. Any other referrer means a wider scope than the sources report.
- Correlate the script fetch with data.debugbear.com traffic from the same client and time window [S1]
- Possible look-alike: sites legitimately using DebugBear RUM will also contact DebugBear hosts. Whether data.debugbear.com is used in normal RUM operation is not stated in the sources (see open questions).
Scope
Affected
- Websites embedding DebugBear RUM monitoring JavaScript, including Polymarket.com [S1]
- Logged-in Polymarket users whose sessions were targeted [S1]
Only if
- Website embeds DebugBear RUM monitoring JavaScript
Not affected if
- Website does not use DebugBear RUM embed code
Enumerate
- Your web properties, tag managers and CSP allowlists that reference debugbear.com
- Internal hosts and users that fetched C7xcKKrjUnXK.js or contacted data.debugbear.com
- Staff or corporate wallets with Polymarket accounts accessed from corporate devices
Contain
- If your sites embed DebugBear RUM, remove the embed code, as DebugBear advised [S1]. This is reversible.
- Before removal, preserve page source, tag-manager config and proxy logs showing what was served and when.
- Block the script URL and data.debugbear.com at the proxy and DNS layer for corporate users. This is reversible.
- Crypto or token transfers already made cannot be undone. Affected users should rely on Polymarket's stated reimbursement [S1].
Eradicate
- Remove the DebugBear RUM embed from all pages and tag managers [S1]
- The root cause sits with the compromised third-party provider. The sources do not describe how it was compromised.
Recover
- Re-add DebugBear RUM only after the vendor publishes a root cause and remediation. None is in the sources.
- Monitor proxy and DNS logs for further requests to the script path or data.debugbear.com.
Re-enter the loop when
- DebugBear or Polymarket publishes a primary advisory with new IoCs, script paths or a time window
- Reports show the script targeting sites other than Polymarket
- Hunts show the script referenced by your own web properties
- Victim count or loss figures are confirmed or revised
Debrief
- Record which sites embedded DebugBear and the dates the embed was removed
- Record proxy and DNS hits with first and last seen times
- Gaps: no exposure window, no compromise vector, no vendor primary advisory, and loss figures differ ($2.5M traced vs $2M) and are unconfirmed [S1][S2]
Detection coverage — checked automatically
| Category | Source | Status |
|---|---|---|
| Vendor | Impacted vendor / CERT advisory | nothing found — no vendor or CERT page among the thread sources; secondary reporting only |
| Government | CISA KEV | not checkable — no CVE: the catalog is keyed by CVE |
| EDR / endpoint VM | CrowdStrike blog | nothing found — no post names it among the feed's 10 newest items |
| EDR / endpoint VM | Microsoft Security blog | published — Email threat landscape: Q3 2026 trends and insights · Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (names the campaign in the title; the feed text carries no CVE id) |
| EDR / endpoint VM | SentinelOne blog | nothing found — no post names it among the feed's 10 newest items |
| EDR / endpoint VM | SentinelOne Labs | nothing found — no post names it among the feed's 10 newest items |
| WAF / edge | Akamai blog | nothing found — no post names it among the feed's 1185 newest items |
| WAF / edge | Cloudflare WAF managed-ruleset changelog | nothing found — no post names it among the feed's 139 newest items |
| Cloud / container | Wiz blog | nothing found — no post names it among the feed's 719 newest items |
| IDS / research | Cisco Talos blog | published — IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases (names the campaign in the title; the feed text carries no CVE id) |
| Detection content | Elastic detection rules | published — 4 files name JavaScript: rules/windows/execution_susp_javascript_via_deno.toml, rules/network/execution_cassandra_javascript_udf_creation.toml, CLI.md, rules/macos/defense_evasion_safari_config_change.toml |
| Detection content | Elastic Security Labs | published — Auditing the auditor: Unmasking Apex Accelerator (names the campaign in the title; the feed text carries no CVE id) |
| Detection content | SigmaHQ rules | published — 16 files name JavaScript: rules/windows/process_creation/proc_creation_win_mshta_javascript.yml, regression_data/rules/windows/process_creation/proc_creation_win_mshta_javascript/info.yml, rules-emerging-threats/2024/TA/Forest-Blizzard/README.md, regression_data/rules/windows/process_creation/proc_creation_win_mshta_javascript/67f113fa-e23d-4271-befa-30113b3e08b1.json |
| Detection content | Splunk ESCU | published — 10 files name JavaScript: detections/endpoint/execute_javascript_with_jscript_com_clsid.yml, detections/endpoint/macos_osascript_executing_javascript_code_with_objc.yml, stories/quietvault.yml, lookups/csv/asr_rules.csv |
| MSSP / IR firms | Arctic Wolf blog | nothing found — no post names it among the feed's 10 newest items |
| MSSP / IR firms | Huntress blog | nothing found — no post names it among the feed's 754 newest items |
| MSSP / IR firms | Rapid7 blog | published — Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 (names the campaign in the title; the feed text carries no CVE id) |
| MSSP / IR firms | Sophos threat research | nothing found — no post names it among the feed's 15 newest items |
| Research | Unit 42 | nothing found — no post names it among the feed's 15 newest items |
Checked automatically 2026-11-10 21:16Z from public sources: 7 published, 11 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.
What a person would still look up (4)
| Secure web gateway / proxy | Whether the script URL and data.debugbear.com are logged and blockable, and whether referrer is captured |
| DNS security | Whether queries to data.debugbear.com and cdn.debugbear.com are logged and can be sinkholed |
| Client-side / web supply chain monitoring | Whether third-party script changes on your own sites are inventoried and alerted |
| CSP / web app config | Whether CSP or tag-manager policies allow debugbear.com sources |
Exposure queries — generated automatically
shodan · alias · card
http.title:"DebugBear"
open · Banner spelling suggested by the model from the card text (vendor name of the RUM monitoring product whose script was compromised; page title of its web console); counted against Shodan before it was shown.
2services internet-wide on Shodan · 2026-11-10▬ 2 on 2026-11-02 (+0 +0%) · 2 on 2026-11-09 (+0 +0%)
Internet-wide count, trend
| Query | First | Latest | Change |
|---|---|---|---|
http.title:"DebugBear" | 2 2026-11-02 | 2 2026-11-10 | +0 (+0%) over 9 days |
Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.
No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.
Banner spellings: a model read 3 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest were dropped.
Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 21:16Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.
Open questions
- How was the provider compromised, and over what time window was the malicious script served?
- Was the script served to sites other than Polymarket?
- Is data.debugbear.com part of DebugBear's normal RUM service? This affects false-positive rate.
- How many users were affected, and what were the confirmed user losses?
- Has DebugBear issued its own advisory?
Sources
- [S1] https://www.bleepingcomputer.com/news/security/polymarket-halts-trading-after-crypto-draining-script-breach-25m-traced/ · BleepingComputer
- [S2] https://www.securityweek.com/2-million-drained-from-polymarket-traders-in-new-supply-chain-attack/ · SecurityWeek
Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.