On Oct 29, prediction market Polymarket halted trading after users reported withdrawals they never made. The code doing it wasn't Polymarket's. It came from DebugBear, a company whose script measures how fast pages load for real visitors. On Nov 2, DebugBear said "our DNS server records were compromised through our domain registrar," per SecurityWeek. Whoever controls a domain's DNS decides what a web address serves. The attackers pointed DebugBear's script address at their own server and swapped Polymarket's copy for a wallet drainer.

What it did. The fake script used traders' open sessions to sell positions or move funds to the attacker, per The Hacker News. Polymarket counts 726 affected wallets and about $2.7 million stolen. It's returning $3.9 million in total, including losses from the trading pause. DebugBear says it found no sign its own systems were breached, and it hasn't explained how the attackers got into its registrar account.

Why small businesses should care. Your website probably loads scripts from outside companies too: analytics, chat widgets, booking tools, ad pixels. Each is a door you don't control. And your own domain sits at a registrar, guarded by one login. If someone takes over that login, they can redirect your site and your email.

Action item: Lock the keys to your domain.
1. Secure the registrar login. Turn on two-factor at your registrar (GoDaddy, Namecheap, Squarespace and so on), and make sure the account email is one you still check.
2. Ask for registrar lock or registry lock. Transfer lock is usually free. Registry lock costs more but blocks DNS changes without a manual check.
3. List your outside scripts. Ask your web developer which third-party scripts your site loads, and remove any you no longer use. Sites that handle payments or logins should ask about serving reviewed copies from their own domain.

Not sure who holds your domain or when it expires? KeyRing checks it free in about 10 seconds.

Second item: Unplug no-name Android TV boxes. Google and industry partners took down a botnet of more than 1.3 million Android TV set-top boxes, per Krebs on Security. Google says the maker, Videostrong, deliberately loaded the malware, which rented owners' internet connections to strangers and ran ad fraud. The same malware turned up in telehealth devices, karaoke machines and digital signage. The Hacker News reports owners can't remove it themselves.
• If you have a cheap streaming box sold on promises of "free" TV channels, unplug it.
• If you keep it, move it to your guest Wi-Fi, away from work laptops and the office file server.

Also today

"IT support" on Teams may not be IT. Microsoft reported two break-ins where attackers messaged staff on Teams from outside accounts posing as the help desk, then talked them into opening Quick Assist, per The Hacker News. There's no patch because nothing was broken. Tell staff to confirm any unexpected support call through a known channel before sharing a screen, and limit which outside organizations can message your team.