TOSHIBA, MUJI SITES HIT BY FAKE LOGIN PROMPTS

Both companies discovered unauthorized login forms being injected into their sites, likely through a compromised JavaScript polyfill dependency. Visitors were presented with legitimate-looking authentication screens that captured usernames and passwords. Polyfills are code libraries that provide functionality for older browsers. When compromised at the source level, they can inject malicious content across thousands of websites simultaneously, making them attractive targets for attackers. Toshiba and Muji have since issued warnings advising users to reset passwords if they entered credentials while seeing these prompts. The companies are working to identify and remove the malicious code. This incident highlights the risks of third-party dependencies in web development. A single compromised library can expose multiple major retailers and their customers to credential theft. Security experts recommend auditing all external scripts and implementing Content Security Policy headers to limit injection attacks.