Evidence and Existing Defenses
How much of the digital supply chain a defender can actually see, the historical record of confirmed operations, the defenses already deployed, and the cybersecurity frameworks the discipline works inside each bear on ATG, and each covers only part of it.
The confirmed historical record covers nine categories of ATG-class event documented in the public record. Taken together, they establish that ATG is operational, accelerating, and multi-vector.
The claims in this record carry different levels of support. The table below separates what is confirmed in the wild from what rests on research demonstration, structural inference, or a stated working presumption, so each assertion can be weighed on its own basis.
| Claim or capability | Support level | Basis |
|---|---|---|
| Targeted content substitution through an acquired, trusted supply-chain node | Confirmed in the wild | Polyfill.io / Funnull (2024): 110,000+ sites; operator OFAC-sanctioned in 2025 |
| Client-side script injection that reads and exfiltrates what the page renders | Confirmed in the wild | Magecart family (payment-card skimming) |
| Substitution of a third-party script by an actor holding the network path, delivered to selected requesters | Confirmed in the wild (adjacent: on-path placement, not supply-chain placement) | Great Cannon (2015): analytics and advertising scripts, served over unencrypted HTTP, answered with substituted JavaScript for a selected fraction of requesters; executed in bystander browsers outside China; attributed to the Chinese state by the Citizen Lab |
| Open-source maintainer takeover reaching downstream builds | Confirmed | event-stream and ua-parser-js (delivered); XZ Utils, 2024 (near-miss for reach) |
| Build-pipeline compromise with long operational dormancy | Confirmed (adjacent: backend, not the rendering layer) | SolarWinds / SUNBURST (2020) |
| AI deepfake deception at eight-figure stakes | Confirmed capability (social engineering, not supply-chain injection) | Arup, Hong Kong, US$25 million (2024) |
| Demand and scale for cloning trusted news brands | Confirmed (adjacent: uses separate infrastructure) | Doppelganger, Russia-attributed, since 2022 |
| Two-Stage Attack: a hash-valid script carries the attack in the runtime data it fetches, defeating static verification | Demonstrated in part; structural | Evasive payloads observed (the Polyfill payload activated by device and time); no single public end-to-end rendering-layer case |
| Endemic Flaw: browser defenses (CSP, SRI, Trusted Types) have no equivalents outside the browser | Structural inference | Absence of equivalent runtime defenses across mobile, desktop, OT, vehicle, AR/VR, and productivity runtimes |
| ATG operational at scale today, including well-resourced and nation-state use | Working presumption (stated as such) | Inference from architectural conditions, not an established finding |
| On-device, per-target tailored deception at population scale (weapons of mass deception) | Structural inference and working presumption | Extrapolation from confirmed deepfake capability and the CSR architecture |
Four defenses are already deployed against this: Content Security Policy, Subresource Integrity, Zero Trust Architecture, and Server-Side Rendering. Each helps, and each stops short for reasons built into how it works. They converge on the Endemic Flaw: the weakness sits in the architecture itself, so it turns up in every runtime separately rather than spreading from one to the next.
ATG can be placed inside the frameworks the discipline already uses: CVE/NVD, MITRE ATT&CK, NIST SP 800-161, and the regulations that apply sector by sector. None of them holds it comfortably, and five gaps in the standards follow.