Security researchers at Report URI have identified 15,579 websites currently infected with malicious JavaScript code, collectively receiving more than 135 million visits each month. However, the organization faces a significant challenge: notifying all the affected site owners in a timely and efficient manner.
According to the blog post, Report URI’s threat intelligence capabilities have become increasingly effective at detecting compromised websites, but the organization’s ability to conduct responsible disclosure—the process of alerting organizations to vulnerabilities—has not kept pace. The researchers are discovering infections faster than they can notify affected parties.
The malicious JavaScript infections take several forms. Credit card skimmers, often called “Magecart” attacks, target payment pages to steal full card details. ClickFix attacks trick users into completing security challenges that actually install malware on their devices. Some infections load device-specific exploits like DarkSword or Coruna spyware targeting certain iOS versions. Others redirect visitors to fake login pages for phishing, fake security warnings, or scams.
Websites become infected through multiple vectors. Direct compromise typically involves WordPress vulnerabilities where attackers modify the site’s own JavaScript files. Supply chain compromises occur when a third-party script that a site loads becomes infected, exposing all visitors. Traditional cross-site scripting (XSS) vulnerabilities allow JavaScript injection. A threat group Report URI named “DeadTag” purchases expired domains that websites still load scripts from, then serves malware through those revived domains.
The scale of the problem is substantial. While the 15,579 currently infected sites identified represent only those confirmed with certainty, thousands more sites are suspected but not yet verified. In September alone, the researchers identified numerous new infections. The impacted sites are not global internet leaders but include many regional powerhouses—highly ranked sites in countries like France, Spain, and Germany that still generate significant traffic despite not cracking the global top million.
Report URI continues attempting direct outreach to particularly high-impact sites, but the effort remains small-scale. The organization notes that responsible disclosure is resource-intensive, adoption of security.txt files is low, and most outreach emails and messages go unanswered. Without customer relationships like they would have with paying clients, obtaining contact information for discovered sites is difficult.
The organization is now requesting assistance. Report URI is offering to share regional lists of infected sites with national cybersecurity agencies (NCSC/CERT offices, particularly in Europe) in hopes they have greater success notifying website owners. The researchers acknowledge they lack a clear solution and are openly soliciting suggestions from the security community on how to scale their notification efforts to better protect the millions of users visiting these compromised websites.
Key facts
- 15,579 websites identified with malicious JavaScript infections
- Combined 135 million monthly visits across infected sites
- Four main infection types: credit card skimmers, ClickFix malware, device exploits, and redirect attacks
- Four primary compromise vectors: direct compromise, supply chain, XSS vulnerabilities, and expired domain exploitation
- Responsible disclosure process consuming significant resources with low response rates