Jakarta — In a sweeping and alarming discovery that underscores the persistent vulnerabilities of the modern internet infrastructure, cybersecurity researchers have identified more than 15,000 websites heavily infected with malicious JavaScript code. The compromised digital properties, spanning regional portals and high-traffic domains, are collectively estimated to pull in a staggering 135 million visits every month. This massive volume of traffic has raised acute concerns among global digital security experts, who warn that millions of unsuspecting internet users face severe risks ranging from financial fraud to advanced device compromise.
The alarming findings were brought to light by prominent cybersecurity researcher Scott Helme through a comprehensive threat intelligence report published on Friday, November 6, 2026. The data underpinning the report was gathered and analyzed through rigorous monitoring systems operated by Report URI, a recognized web security firm specializing in Content Security Policy (CSP) enforcement and threat detection. According to the telemetry data, the compromised websites are clandestinely executing malicious scripts designed to perpetrate various cybercrimes, including the skimming of credit card details, the broad distribution of malware payloads, and the stealthy redirection of visitors to sophisticated phishing portals.
“We have identified 15,579 websites that are currently actively infected with malicious JavaScript,” Helme stated in the report. “Based on our conservative metrics and traffic estimation models, these affected domains collectively receive in excess of 135 million visits every month.”
The Anatomy of the Threat: From Magecart to iPhone Exploits
The breadth and sophistication of the malicious scripts uncovered in this latest wave of infections highlight a worrying evolution in web-based threat vectors. Rather than relying solely on traditional malware downloads, attackers have embedded multifaceted exploits directly into the frontend and backend architectures of legitimate websites, transforming trusted domains into vectors of compromise.
Among the primary threats identified by the Report URI research team is Magecart-style digital skimming. This insidious form of malware is injected into online checkout and shopping cart pages, quietly harvesting sensitive financial data—such as credit card numbers, expiration dates, and CVV codes—the moment an unsuspecting customer enters their information to complete a transaction. Because the attack occurs client-side within the browser environment, victims rarely notice any visual anomaly on the webpage, making detection exceptionally difficult for the average consumer.
In addition to financial fraud, researchers uncovered widespread deployment of the "ClickFix" social engineering campaign. This tactic manipulates users by displaying deceptive verification prompts—such as fake "Prove you are not a robot" captchas or system update warnings. When victims attempt to follow the instructions to clear the prompt, they are manipulated into executing unauthorized terminal commands or PowerShell scripts, effectively installing backdoor malware directly onto their machines.
The threat landscape mapped by the report also extends deeply into mobile ecosystems. Certain infected domains were found to be executing scripts capable of probing visitor devices for vulnerabilities, facilitating targeted attacks and attempting to deploy advanced mobile spyware variants, such as DarkSword and Coruna, particularly targeting iPhone users through browser exploit kits.
Furthermore, threat actors have leveraged a clever technique known as "DeadTag." In these scenarios, malicious actors purchase expired or abandoned domain names that are still actively referenced by other websites to load external JavaScript libraries or tracking scripts. By controlling the expired domain, the attackers can inject malicious payloads directly into the host websites without ever needing to breach the primary servers of those websites.
Vulnerability Pathways: How Websites Get Compromised
The sheer volume of infected sites raises critical questions regarding how such a vast array of web properties could be simultaneously subverted. According to the technical breakdown provided in the Report URI findings, the malware infiltrates these domains through a combination of classic vulnerabilities and modern supply-chain blind spots.
A significant proportion of the compromises can be traced back to unpatched or outdated Content Management Systems (CMS), particularly WordPress, which powers a massive share of the global internet. Vulnerable plugins, themes, and core software installations provide easy entry points for automated threat actors scanning the web for weak administrative credentials or unpatched vulnerabilities.
Beyond direct server breaches, third-party component vulnerabilities represent a major attack surface. Modern websites routinely pull in scripts from external vendors—such as analytics providers, advertising networks, widget creators, and customer support chat modules. If a third-party vendor is compromised, every website utilizing their script inherits the malicious code, creating a cascading supply-chain failure. Cross-Site Scripting (XSS) vulnerabilities further exacerbate the issue, allowing attackers to inject persistent scripts into databases that are subsequently served to every visitor.
The Communication Bottleneck: A Race Against Time
While identifying thousands of compromised websites represents a major technical achievement for security researchers, it has also laid bare a critical structural weakness in contemporary cybersecurity incident response: the severe friction involved in notifying affected web administrators.
Report URI’s detection mechanisms are capable of flagging infected domains with high speed and precision. However, bridging the gap between detection and remediation has proven to be an immense logistical challenge.
“We are now finding infections at a rate far exceeding our capacity to effectively notify the impacted organizations,” Helme explained.
The notification bottleneck is driven by several compounding factors. Many of the affected website operators do not monitor the administrative email addresses associated with their domains. Furthermore, a significant percentage of the compromised websites fail to provide clear, accessible, or functional security contact information—such as a dedicated security.txt file, an abuse email alias, or an active security operations desk. Consequently, the vast majority of outreach attempts sent by researchers go unanswered, leaving millions of visitors exposed while site owners remain completely oblivious to the fact that their digital properties are actively harming their users.
Compounding the urgency of the situation, the researchers noted that a substantial portion of the affected domains belong to prominent regional brands and well-known public-facing portals, particularly within European jurisdictions. The presence of high-profile entities on the compromised list amplifies the potential for widespread data exfiltration before remediation can take place.
Mobilizing Global Incident Response Teams
Recognizing that independent research teams alone cannot manage the monumental task of notifying thousands of website operators, Report URI has begun pivoting its strategy. The organization is actively seeking the assistance of national cybersecurity agencies, Computer Emergency Response Teams (CERTs), and regulatory bodies across various regions to help streamline and accelerate the dissemination of warnings to affected organizations.
By leveraging government-backed channels and institutional authority, researchers hope to bypass unresponsive administrative contacts and compel website operators to audit their codebases immediately. Security analysts emphasize that swift cooperation between private security firms and public sector incident responders is vital to neutralizing campaigns of this scale before they result in catastrophic data breaches.
Practical Defense Strategies for Internet Users and Website Operators
Given the clandestine nature of modern web-based malware—where compromised pages appear completely legitimate and harmless to the naked eye—cybersecurity professionals stress the importance of a multi-layered defense strategy for both everyday internet users and website administrators.
For consumers navigating the web, standard precautions remain essential:
- Browser and Operating System Hygiene: Always keep web browsers, mobile operating systems, and security software updated to the latest stable versions to patch known exploit vectors.
- Skepticism Toward Prompts: Never follow instructions that require running manual terminal commands, PowerShell scripts, or downloading executables in response to unexpected browser pop-ups or "verification" requests.
- Vigilance with Financial Transactions: Exercise heightened caution when entering payment information online, and utilize virtual credit cards or secure payment gateways whenever possible to limit potential exposure.
- Account Security: Enable multi-factor authentication (MFA) across all critical online accounts to mitigate the risk of credential stuffing and account takeover.
- Secure Navigation: Avoid clicking on unverified links or downloading applications from dubious sources.
For website owners, administrators, and digital agencies, the imperative is to secure the supply chain and maintain rigorous oversight of digital assets:
- Regular Audits and Patching: Continuously update CMS platforms, plugins, and server dependencies to eliminate known vulnerabilities.
- Script Monitoring and CSP Implementation: Implement a robust Content Security Policy (CSP) to restrict the domains from which scripts can be loaded, and utilize automated integrity monitoring tools to catch unauthorized code modifications instantly.
- Third-Party Risk Assessment: Thoroughly vet all external JavaScript vendors and limit reliance on third-party components that lack transparent security practices.
- Proactive Contact Channels: Establish clear, publicly accessible security contact mechanisms—such as security.txt files—to ensure that researchers and security professionals can report vulnerabilities rapidly without hitting administrative dead ends.
As the digital economy continues to expand, the incident serves as a stark reminder of the fragile interconnectedness of the web. While researchers and security agencies work diligently to map and mitigate these widespread infections, the ongoing challenge highlights the critical need for heightened vigilance, automated security monitoring, and institutional cooperation across the global digital landscape.
