Report URI has flagged more than 16,000 websites serving malicious JavaScript to visitors, and many of their owners are unlikely to know. The NCSC and other national CERTs have now been handed the data, which turns this from a research curiosity into an alert UK organisations may receive this week.
What happened
On 6 November 2026 Scott Helme, the UK researcher behind the Report URI monitoring service, published a blunt appeal for help. His team had confirmed 15,579 websites quietly loading malicious JavaScript, with thousands more under suspicion but not yet confirmed. Between them, those sites draw an estimated 135 million visits a month on a conservative count. The problem he described was not finding the infections. It was telling anyone about them.
By 9 November the confirmed total had climbed to 16,068, an increase of 489 in three days. The same update brought the first real progress: several national cyber security centres and CERTs had asked for the data, and some began issuing warnings that day, though Helme does not say which. Helme names the UK’s NCSC, ENISA at EU level and a number of regional European CSIRTs, and says CISA in the United States has also been approached. For UK domain owners, the route he points to is the NCSC’s free Early Warning service.
The Hacker News picked up the findings in its weekly round-up on 9 November, repeating the original 15,579 figure and the mix of payloads involved.
The technical picture
The infected sites fall into four broad groups by what the injected code does to visitors:
- Card skimming: Magecart-style scripts that sit on checkout pages and copy payment details as they are typed.
- ClickFix lures: fake “verify you are human” prompts that talk the visitor into pasting and running a command, installing malware on their own machine.
- Device exploitation: loaders that check the visitor’s iOS version and serve the Coruna or DarkSword exploit kits to vulnerable iPhones.
- Redirects: traffic diverted to credential phishing pages, bogus security warnings and assorted scams.
How the code gets there varies. Some sites have been directly compromised, often through WordPress vulnerabilities. Others have been hit through their supply chain, where a third-party script the page pulls in has itself been tampered with. Plain cross-site scripting flaws account for some. The most insidious route is one Report URI has labelled DeadTag. In research published in October with iVerify, Helme described an operator that buys up expired domains once used by defunct analytics, advertising and widget providers. Any site still carrying the old tag then serves the new owner’s code to every visitor. That study counted more than 660 re-registered domains, and its traffic estimate matches the 135 million monthly visits now quoted for the wider set.
Helme notes that many affected sites are significant regional businesses, particularly in France, Spain and Germany, rather than household global brands. They rarely appear in the world’s top million domains but still see heavy traffic, which is exactly the profile of an organisation without a dedicated security team watching its front-end code.
Why it matters for UK organisations
The interesting part of this story for defenders is the notification gap. Helme sets out why the obvious channels fail. Few sites publish a security.txt file. WHOIS records have been largely useless for contact details since GDPR. Content delivery networks and reverse proxies hide which hosting provider actually serves the site. Sending 16,000 cold emails to guessed addresses would mostly go unread and could damage the sender’s mail reputation. Publishing the list would hand attackers a target directory and could see small firms blocklisted for something done to them.
That is why the hand-off to national bodies matters. The NCSC’s Early Warning service is free to any UK-based organisation. You register your public IP ranges and domains through a MyNCSC account, and the NCSC emails daily and weekly reports drawn from its own feeds plus public, commercial and privileged sources. Alerts are grouped as incident notifications, network abuse events, and vulnerability or open port warnings.
The regulatory angle is real, too. A skimmer on a checkout page is likely to be a personal data breach under UK GDPR, with the 72-hour clock for reporting to the ICO starting when you become aware. If the first you hear of it is an NCSC email, awareness may begin at that moment, so the alert needs to land in a monitored mailbox and route straight into your incident process.
Expert view
In my experience, client-side code is the most neglected part of a web estate. When we test e-commerce platforms, the server is usually patched and fronted by a WAF, yet the page still loads scripts from a dozen third parties that nobody has reviewed since the original build. Marketing adds a tag, the campaign ends, the vendor folds, and the reference stays in the template for years. DeadTag is simply the commercial exploitation of that habit.
What makes this class of compromise so hard for a SOC is that nothing on your infrastructure looks wrong. Server logs are clean, EDR is quiet and the malicious request happens in the visitor’s browser. Unless you are collecting browser-side telemetry, the first signal is often a card fraud pattern traced back by a payment provider, or now a government alert.
Helme’s candour is welcome. He admits he has no answer to the disclosure problem: detection at internet scale is cheap, reaching a busy regional business owner is not.
What to do now
- Register for NCSC Early Warning today. List every public domain and IP range you own, including campaign microsites and legacy brands, and send alerts to a shared, monitored security mailbox rather than one person.
- Inventory your third-party scripts. Crawl your own pages and list every external domain they load code from. Remove anything tied to a service you no longer pay for, and check that the remaining domains are still registered to the vendor you expect.
- Deploy a Content Security Policy in report-only mode first. Point the reports at a collector so you can see which script sources your pages actually use, then tighten to an allow-list. Treat unexpected new sources as an incident.
- Add Subresource Integrity to static third-party scripts where the vendor serves fixed versions, so altered files fail to load.
- Patch your CMS and plugins. This is Cyber Essentials security update management: high and critical fixes within 14 days, and unsupported plugins removed.
- Publish a security.txt file so researchers who find a problem can reach the right people quickly.
- Write the playbook now. Decide who triages an external alert about injected code, how you confirm it, how you take the script out, and when you notify the ICO and your payment provider.
Bottom line
Sixteen thousand infected websites is a large number, but the more telling figure is how few owners could be reached directly. The NCSC now holds the UK portion of that data. If your organisation has not registered its domains for Early Warning, it cannot receive that warning, and a compromise happening in your customers’ browsers will stay invisible to your own monitoring.
