Compromised websites are currently driving over 135 million visits every month while serving harmful payloads to unsuspecting visitors. The attacks leverage vectors such as WordPress vulnerabilities, supply chain scripts, and expired domain acquisitions orchestrated by the threat group DeadTag. Notification efforts have stalled because website contact details are largely missing and the adoption of security.txt remains minimal. As most outreach emails go completely unanswered, security experts are appealing directly to European national cybersecurity centers to distribute the threat data locally.
Key points
Direct site remediation is severely impeded by low security.txt adoption and unanswered n…: Direct site remediation is severely impeded by low security.txt adoption and unanswered notification emails sent to webmasters.
Supply chain compromises and vulnerabilities in content management systems like WordPress…: Supply chain compromises and vulnerabilities in content management systems like WordPress remain the primary drivers of these infections.
European national cybersecurity centers and CERTs are being urged to step in and help ale…: European national cybersecurity centers and CERTs are being urged to step in and help alert regional domain owners.
Sources checked by our analysis pipeline: 1
We've identified 15,579 websites that are currently infected with malicious JavaScript and between them, we conservatively estimate that they receive more than 135 million visits every month.
We know they're infected, and we have the evidence to back that up, but there's a problem: how on Earth do we tell them all?
As our Threat Intelligence capabilities at Report URI have grown, identifying compromised websites has become increasingly efficient. Unfortunately, responsible disclosure hasn't kept pace, and we're now finding infections considerably faster than we could ever hope to notify the affected organisations.
I genuinely don't know how to solve this problem, so I'm asking for help.
What attacks we're finding
At the core of it, we're finding websites that are running JavaScript that they should absolutely not be running! For some examples of how nasty this can be:
- Credit card skimmers - often known as 'Magecart', they target payment pages and skim full card details to send them to the attacker.
- ClickFix attacks - designed to trick users into completing a "prove you're human" challenge and instead installing…
Aiming to demonstrate peaceful civilian uses for Cold War defense systems, military officials partnered with postal leadership to test extreme-speed delivery via defense hardware. The flight replaced a standard nuclear payload with postal containers to showcase the accuracy and rapid transit capabilities of submarine-launched cruise systems. Despite high-profile predictions about the future of global communications, the demonstration ultimately remained a one-time trial rather than a permanent transit solution.
European regulators found that the social media platform fails to properly evaluate how its recommendation systems trap audiences in rabbit holes of potentially triggering content. Brussels is now demanding architectural changes to safeguard user well-being under the Digital Services Act. Failure to comply could expose the company to penalties amounting to a substantial fraction of its global turnover.
The software giant has begun winding down external computing power secured through a previous infrastructure partnership. This pullback occurred because the leased systems relied on older-generation Nvidia silicon rather than more modern hardware. Consequently, the company decided against continuing the multi-year vendor relationship for those specific resources.