DebugBear, a Real User Monitoring tool widely used by SEO experts, reported an attack. Site owners must remove its script and check for unauthorized access.

Who this affects: This security alert concerns website owners using DebugBear’s Real User Monitoring script.

DebugBear told customers to remove its Core Web Vitals monitoring script. Site owners should also check exposed accounts and unauthorized changes.

If your website uses DebugBear’s Real User Monitoring script to track Core Web Vitals, remove it now. The company issued that instruction on October 29 after reporting a security incident involving its infrastructure.

Example of the embed code to remove. The script ID varies by site:

SEO teams should flag this to their development and security teams, who should remove the script and investigate any unauthorized access or changes made while it was active.

In a follow-up update, DebugBear said attackers compromised its DNS records through its domain registrar. DebugBear said its initial investigation showed that the attack targeted one customer’s website. It reported no indication that its internal systems had been compromised.

In the same update, DebugBear said it could not receive email sent to its domain. Customers can follow updates on DebugBear’s X account.

Cybersecurity firm Hudson Rock’s analysis found malicious JavaScript at a DebugBear script URL used by Polymarket on October 29. The code sought the trading client already available in a logged-in browser. Polymarket’s October 30 incident report confirmed that the script sold positions and moved funds from some users’ wallets. It used the access a signed-in visitor already had and did not need the user’s password.

Source link