Toshiba and Muji Warn of Suspicious Login Prompts Linked to Polyfill.io
Summary
Toshiba and Muji warned of suspicious login prompts linked to polyfill[.]io; other Japanese organizations were also reportedly affected. Both companies say they resolved the issue, and there is no indication of hacking or credential theft.
Key points
- Toshiba and Muji warned visitors not to enter information into unexpected sign-in prompts linked to polyfill[.]io.
- The prompts reportedly appeared when browsers interpreted HTTP 401 authentication responses from the external service.
- Japanese media also reported impacts at Zojirushi, FiNC Technologies, Ishiyaku Publishers, and Hobonichi.
- Both Toshiba and Muji said they had resolved the issue and suspended the service; users who entered credentials were advised to change their passwords.
- Muji said it had not confirmed unauthorized access or information leakage. The article reports no indication that affected websites were hacked or that credentials entered into the prompts were stolen.
- The issue may involve leftover Polyfill code from the 2024 incident; the article says some reports attribute the problem to that incident.
Article Details
- Event Type
- Suspicious authentication prompts appeared on websites that retained code referencing polyfill[.]io, which began responding with HTTP 401 authentication requests.
- Impact
- Visitors to affected websites, including Toshiba and Muji, could have been prompted to enter credentials. The article reports no indication that credentials were stolen or that the affected websites were hacked; Muji also said it had not confirmed unauthorized access or information leakage. Toshiba and Muji said they had resolved the issue and suspended the service.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | polyfill[.]io | Domain associated with the suspicious login prompts; the article says it previously delivered malicious scripts and began responding to requests with HTTP 401 authentication prompts. |
People
Andrew BettsCreator of the Polyfill project who publicly recommended that website owners remove the service after the 2024 incident.Pasquale PillitteriSecurity researcher who reported that Samsung Smart TVs and websites displayed a login prompt on June 1 and reported renewed activity from polyfill[.]io.
Industries
PublishingJapanese media outlets reported that Zojirushi, FiNC Technologies, Ishiyaku Publishers, and online publishing brand Hobonichi were also impacted by the same issue.RetailJapanese retail giant Muji published a similar announcement earlier this week, warning website visitors of suspicious authentication screens generated by the external service polyfill[.]io.