Your Website May Be Secure. But Can You Trust Every Script Running on It?

The recent cyberattack on Polymarket, resulting in approximately $2.7 million in stolen cryptocurrency, highlights a serious security concern that many organisations overlook: the risks associated with third-party JavaScript running inside their web applications.

Attackers reportedly compromised the delivery of a DebugBear performance-monitoring script used by Polymarket. The malicious code executed within authenticated users' browser sessions and manipulated trading operations to transfer funds to attacker-controlled wallets.

What makes this attack particularly concerning is that attackers did not need to steal users' passwords or private keys. Instead, they abused functionality already available within authenticated browser sessions to initiate unauthorised transactions.

Modern websites routinely integrate third-party scripts for analytics, performance monitoring, customer support and other services. While these integrations improve functionality, they can also introduce security risks when external code is compromised.

This incident demonstrates why protecting the web server and application APIs alone is not sufficient. Organisations must also understand what code executes inside their customers' browsers and what privileges that code can exercise.

Client-side security, third-party script integrity, Content Security Policy (CSP), Subresource Integrity (SRI) and continuous monitoring of application behaviour are becoming increasingly important. Sensitive transactions should also have independent authorisation controls that cannot be silently bypassed by compromised browser-side code.

At GajShield, we believe effective Web Application and API Protection must evolve beyond identifying conventional attacks such as SQL injection, cross-site scripting and malicious bots. Security strategies must increasingly consider supply-chain risks, application behaviour and the potential misuse of legitimate authenticated sessions.

The Polymarket incident is a reminder that even trusted software components can become an attacker's entry point.

The larger cybersecurity lesson is simple: Securing your application is important, but securing everything your application trusts is equally important.

Because sometimes the biggest threat to your website comes from the code you willingly allow to run on it.

A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals. [...]

Source: Hackers use n-day exploits in zero-click attacks on iOS, Android devices via Bleeping Computer — published 04 Nov 2026.