Polyfill Supply Chain Attack Linked to North Korean Threat Actors In February 2024, the widely used Polyfill.io service a JavaScript library for browser compatibility was acquired by Chinese CDN company Funnull. Shortly after, the domain cdn.polyfill.io began injecting malicious code into scripts, affecting over 100,000 websites. The malware targeted mobile users, redirecting them to betting and adult sites while employing evasion techniques. Security firms Sansec and C/side confirmed the attack in June 2024, prompting Cloudflare and Google to mitigate risks. Initially attributed to Chinese actors, new evidence from cybersecurity firm Hudson Rock reveals North Korean involvement. The firm analyzed data from infostealer malware on a device used by a North Korean hacker, uncovering credentials for Funnull’s DNS management portal and the Polyfill Cloudflare tenant. The stolen data also included conversations about malicious domain configurations, establishing a direct link between the North Korean operative and the attack. Hudson Rock determined that the Polyfill campaign aimed to funnel users to gambling sites operated by China’s Suncity Group, which allegedly laundered cryptocurrency for North Korea. The operation aligns with North Korea’s broader cybercrime strategy, which reportedly stole over $2 billion in cryptocurrency in 2025. Additionally, the same hacker’s device contained evidence of a separate scheme where a North Korean operative infiltrated cryptocurrency exchange Gate.io to gather intelligence on anti-money laundering procedures.