nDiligence Releases Attack the Glass, Showing Attackers Can Alter Screens After Security Checks

nDiligence, Inc. today announced the release of Attack the Glass (ATG) research to the general public. The four-year study examines a cybersecurity vulnerability in how applications use people’s own devices to build what appears on screen, load data and run code while the application is in use. An attacker who exploits it can change what people see and what their software does, after every security check has passed. The full research, including demonstrations and defense playbooks, is available free at https://atg.nDiligence.com.

Much of the software people rely on builds its user interface on the device itself. Web browsers, mobile and desktop applications, smart TVs, vehicle displays, medical devices, point-of-sale terminals and industrial control screens receive code, data and media, then assemble what the person sees and uses while it is running. This is runtime client-side rendering.

That code, data and media rarely come from one organization. A single application can draw on dozens or hundreds of sources: the organization’s own systems, the vendors it uses for features such as maps, payments, analytics or advertising, and the vendors those vendors rely on. Each supplier’s contribution is loaded into the running application and executed on the user’s device.

An attacker who gains control of any one of those suppliers gains placement and access: a position inside the application while it runs on the user’s device, with the same capabilities as the legitimate code.

This is a blind spot in modern cybersecurity. Sign-in, encryption, Zero Trust, firewalls and code review all function before the code is loaded onto the device. Once loaded, the code is trusted, and nothing checks what it does. An attacker in that position can change what appears on screen, capture what the person types and take actions in the application with that person’s authority. The result is a software supply-chain attack carried out directly on the user’s device, after every security check has passed, and most cybersecurity systems in use today are not built to detect or stop it.

It is already happening. In February 2024 the domain behind Polyfill.io, a code library loaded by more than 100,000 websites, was sold to Funnull, a company the U.S. Treasury sanctioned in 2025. The new owner began serving altered code to selected visitors through the same channel those sites had always trusted, targeting mobile users and hiding from administrators and security scanners. Funnull controlled the domain for months before the altered code was flagged, and no automated security tool detected it. It came to light only when independent researchers reported it in June 2024 and the domain was shut down.

The Polyfill.io operator used its placement and access in the supply chain of more than 100,000 websites to redirect people to scam sites. The ATG research shows the same position could carry far more consequential operations. The underlying vulnerability was never fixed.

Influence operations show what is at stake. Doppelganger, a Russia-attributed influence campaign whose websites the U.S. government seized in 2024, impersonated real news outlets using lookalike domains, altered in small ways designed to deceive readers and go unnoticed. Those domains are how it was caught. An operation using ATG would not need a cloned website. The real site, at its real address, would deliver the altered content to the readers the attacker chooses, leaving nothing for an editor or fact-checker to find.

Beyond the news, the ATG research documents how the same technique could be used for:

• Disinformation from trusted sources: altered articles, statements, polls or election results shown to chosen readers inside genuine news, government and election sites.
• Deepfakes delivered from the inside: AI-generated images, audio and video placed into real applications, tailored to each viewer.
• Military and government decisions: an operations picture, intelligence dashboard or public-service system showing commanders, analysts or officials something other than what is true.
• Critical infrastructure: a grid, water or pipeline operator’s screen showing normal readings while conditions change, or controls that no longer do what they show.
• Financial systems: balances, prices or approval screens altered, so trades and transfers are made on false information.
• Systems disabled by hiding: alerts, evacuation notices, reporting buttons or safety controls removed for some users, while staff see them working normally.

Due to security concerns from this type of threat, the team behind nDiligence spent more than two years, starting in April 2024, privately briefing governments, researchers and industry experts around the world before publishing. A weakness in how screens are built is a vulnerability in how militaries, governments, infrastructure operators, markets and newsrooms make decisions, take action and command systems. The ability to exploit it without detection, attribution or evidence makes it a significant national security and cybersecurity risk.

“People trust what they see with their own eyes. In the modern world we are constantly looking at screens, and we have grown to trust applications, websites, devices and companies, assuming they have 100% control over what is shown to us,” said Robert Beckett, founder and CEO of nDiligence, who led the four-year research into the ATG vulnerability. “ATG demonstrates how an attacker can hijack that trust without detection or attribution. A commander, a grid operator, a voter or a reporter can be looking at a screen that every security system says is safe, and what it shows can be manipulated. Whoever controls the screen can influence what people believe, decide and do, with sophisticated targeting. And right now, nobody can tell when or where it is happening. The cybersecurity community needs to understand this vulnerability so we can protect the integrity of software systems across industries, governments and critical infrastructure.”

Findings

nDiligence examined 50 types of software and devices across 10 categories, from web browsers and mobile apps to vehicles, medical equipment and industrial control systems. All 50 are vulnerable, and 46 rate Critical or High risk. Closed, air-gapped and classified networks have smaller, better-controlled supply chains, which reduces their exposure but does not remove it, because they are built from the same upstream components. Existing defenses such as Content Security Policy and Subresource Integrity also reduce the risk, but none removes it.

The ATG research classifies five types of effects an attacker can achieve through supply-chain injection:

• Deceive: show false information while everything else works normally.
• Disrupt: make a feature appear to work while it does nothing.
• Degrade: slow or stall systems without causing a visible failure.
• Deny: remove an option, notice or control that a person needs.
• Destroy: use the signed-in person’s authority to delete or damage the systems and data behind the screen.

These effects can be combined and aimed at everyone, one group or one person, using the same targeting tools that decide who sees an online advertisement.

What is released

All materials are free to the public, marked Traffic Light Protocol (TLP) CLEAR for unrestricted sharing and licensed under Creative Commons Attribution 4.0:

• A 16-chapter technical whitepaper and a shorter technical primer.
• 20 working online demonstrations across banking, healthcare, energy, elections, defense, trading and other sectors, using illustrative organizations.
• Remediation playbooks for engineers, architects and security teams, organized into the first 90 days, months three to 12 and the longer term.
• A concepts registry, frequently asked questions and a downloadable library.

“ATG was discovered during our research into digital supply-chain threats,” said Beckett. “Our team has spent more than 15 years working in online threat intelligence and countering influence operations, which is why we recognized how the ATG vulnerability could be exploited. Since 2024, we have been working with researchers, vendors and governments to find ways to close this gap. Anyone who builds, operates or defends systems that people use to make critical decisions needs to understand and mitigate the ATG vulnerability.”

Who should read it

ATG is an international problem across the global technology sector. The research is relevant to any organization that builds, operates or depends on software that renders on its users’ devices, from governments, militaries and election administrators to news organizations, financial institutions, healthcare providers and critical infrastructure operators, and to the software vendors in their supply chains.