We know 15k websites are infected. how do we tell them?

Over 15,000 websites you might visit are currently serving malicious code, silently compromising your safety.

Security researcher Scott Helme has identified 15,579 websites infected with malicious JavaScript, potentially exposing over 135 million monthly visitors to threats like credit card skimming, malware installation, spyware, and phishing. These infections stem from various attack vectors, including direct compromise of site files, malicious third-party scripts (supply chain attacks), cross-site scripting (XSS) vulnerabilities, and attackers re-registering expired domains to serve malware (DeadTag). Helme's team at Report URI can efficiently identify these compromised sites but faces a significant challenge in notifying the affected organizations due to a lack of scalable responsible disclosure processes and unresponsive communication channels. While they attempt direct outreach to high-impact sites, the sheer volume of infections overwhelms their capacity, prompting a public call for solutions and collaboration with entities like NCSC/CERTs.

The identified infections, ranging from credit card skimmers to spyware and malware delivery, highlight the pervasive and evolving nature of web-based threats. The reliance on third-party scripts and the exploitation of expired domains (DeadTag) demonstrate critical vulnerabilities in the modern web supply chain, affecting even otherwise secure sites. The researcher's inability to effectively notify over 15,000 compromised sites underscores a significant gap in current web security incident response, suggesting a need for automated and scalable disclosure mechanisms.

This situation points to a growing disconnect between the speed of threat discovery and the effectiveness of mitigation strategies. The sheer scale of unaddressed infections suggests that many users are unknowingly at risk, and the current methods of responsible disclosure are insufficient for widespread compromise events. Future solutions may involve industry-wide automated notification systems, enhanced collaboration between security researchers and national CERTs, or new standards for domain expiration and script integrity.