What happened 

Visitors to some Toshiba and MUJI websites recently saw unexpected browser login prompts generated through the external `polyfill.io` service. Both companies warned users not to enter credentials into these prompts and advised anyone who did so to change their passwords. The affected companies also suspended the service and worked to remove the issue from their websites.

This does not currently appear to be a direct compromise of Toshiba or MUJI’s websites. BleepingComputer reported that there is no indication so far that the impacted websites were hacked or that credentials entered into the rogue prompts were stolen. Still, unexpected login prompts on trusted websites are dangerous because users are more likely to trust them without hesitation. That, naturally, is exactly the kind of human shortcut attackers love.

Why it matters 

The issue is linked to remnants of the old `polyfill.io` JavaScript service. In 2024, the `polyfill.io` domain became associated with malicious script activity after the domain changed ownership, affecting more than 100,000 websites using the service. Some websites had removed or disabled the risky service, but leftover code on older pages appears to have continued creating exposure.

This is the real lesson: third-party scripts are not harmless decorations. They run inside the browser, affect the user experience, and can create security risks long after a website team forgets they were ever added. A small external dependency can quietly become a security problem across thousands of pages. Truly, the web has found a way to make forgotten JavaScript everyone’s problem.

What users should do 

Users should never enter credentials into unexpected browser authentication pop-ups, even if they appear on a familiar brand’s website. If a login prompt appears suddenly and does not look like the normal website login flow, the safest action is to cancel it and access the account through the official login page.

Anyone who entered their username and password into these prompts should change their password immediately and enable multi-factor authentication where available. If the same password was reused elsewhere, those accounts should also be updated, because password reuse remains the cybersecurity equivalent of leaving one key under every doormat.

What website owners should learn 

Website owners should audit all third-party JavaScript, CDN references, legacy dependencies, and forgotten scripts across their entire site, not only the homepage. Old pages, archived templates, regional microsites, campaign pages, and legacy checkout flows often carry outdated code that nobody remembers until it becomes a headline.

Security teams should maintain an inventory of external scripts, use Subresource Integrity where possible, monitor script behavior, and remove dependencies that are no longer required. Browser security headers, content security policies, and regular dependency reviews can reduce the risk from compromised or abandoned external services.

Security takeaway 

This incident shows how supply chain risk can survive quietly inside old web code. A company does not always need to be hacked directly for users to face risk. A forgotten third-party script, an abandoned dependency, or an old CDN reference can be enough to create suspicious behavior on a trusted website.

The practical message is simple: users should be cautious of unexpected login prompts, and website owners must clean up old third-party scripts before they become someone else’s credential trap.

Tech giant Toshiba and mega-retailer Muji warned visitors that suspicious sign-in screens popping up on their websites could collect credentials. [...]

Source: Suspicious Polyfill login prompts pop up on Toshiba, Muji websites via Bleeping Computer — published 05 Jun 2026.