15,579 infected websites with 135M monthly visits, and no way to warn them all

Researchers find 15,579 infected sites

Security researcher Scott Helme has disclosed that threat intelligence work at his company, Report URI, has verified 15,579 websites currently serving malicious JavaScript to their visitors. Taken together, those sites receive a conservatively estimated 135 million visits per month, according to a blog post by Helme that reached the front page of Hacker News.

That figure covers only infections his team is fully confident about. Helme writes that a second list of suspected sites, where confidence has not yet reached 100 percent, runs to thousands more. Sites are removed from the tally once they clean themselves up, so the total identified over time is higher still.

Global household names are notably absent from the dataset. Helme says the list is dominated by sites that lead in their own markets, ranking highly in countries such as France, Spain and Germany while sitting well outside the global top one million. Even so, popularity within a single country is enough to accumulate substantial traffic.

What the malicious scripts do

Helme groups the payloads he is finding into four broad categories:

• Credit card skimming, commonly associated with the Magecart label, which captures full payment card details on checkout pages and sends them to attackers.
• ClickFix campaigns, which present visitors with a fake human-verification challenge and, instead of verifying anything, convince them to install malware on their device.
• Device exploitation, where loaded malware targets specific software versions, including iOS payloads that install spyware such as DarkSword or Coruna.
• Redirects that send visitors to fake login pages, bogus security warnings and various scams.

The payload deployed depends on the attacker's objective, and Helme notes that payloads on a compromised site can change over time.

How the sites were compromised

According to the post, infections arrive through four main initial vectors:

• Direct compromise of the site itself, most often through a WordPress vulnerability or something comparable, where the site's own JavaScript files are modified to include malicious code.
• Supply chain compromises, in which a third-party script that many sites load becomes infected, exposing every site that depends on it.
• Cross-site scripting flaws in the site itself, which allow an attacker to inject JavaScript directly.
• A technique Helme's team has named DeadTag, in which a threat actor purchases expired domains that sites still reference for JavaScript, revives them, and serves malware from URLs those sites continue to load.

The problem nobody has solved

The central issue Helme raises is not detection but notification. Because Report URI identifies compromised sites through its own crawling rather than through a customer relationship, it holds no registered contact details for them. Responsible disclosure is resource-intensive, adoption of the security.txt standard for publishing security contact information is low, and Helme reports that the vast majority of outreach emails and messages receive no reply.

The result is that infections are being found far faster than affected organisations can be told about them. Helme says he does not have a clear solution and is openly asking for suggestions in the post's comments.

Two avenues are already on the table. National CERTs and NCSCs, particularly in Europe where many affected sites appear to be located, can request a list of infected sites in their region via Report URI's intelligence contact address, on the reasoning that national bodies may have better channels for reaching organisations in their own countries. Organisations that want commercial access to the threat intelligence feeds can also enquire.

Why it matters

This is a rare quantification of a problem the web security community usually discusses in anecdote-sized pieces. If the estimates hold, more than 135 million visits each month are landing on pages capable of skimming cards, phishing credentials or installing spyware, and a verified list of exactly which pages those are already exists but is going largely unused.

The post also exposes structural gaps: responsible disclosure has no mechanism that scales to bulk website compromise, security.txt adoption remains marginal, and dependencies on expired domains create an attack surface most site owners never monitor. Whether national CERTs take up Helme's offer may determine whether this intelligence ends up protecting anyone at all.