🕷️15,579 Websites Caught Serving Malicious JavaScript to 135M Monthly Visitors

Your site might be skimming card numbers right now

Report URI has identified 15,579 websites running JavaScript they should never be running, and the list keeps growing. Those sites collectively pull more than 135 million visits every month. The malicious code is being used for credit card skimming, ClickFix social engineering, device exploitation, and redirects. If you own or maintain a web app, this is your problem too. The infections get in through direct compromise, supply chain attacks, XSS, and DeadTag, which means a single poisoned npm dependency or an unsanitized input field can turn your checkout page into a skimmer. Your CSP and your third-party script inventory are the first things to check. The bottleneck is human. Responsible disclosure is slow, expensive, and doesn't scale, and most emails to the affected sites go unanswered. Report URI is now contacting high-impact sites directly, but it has no contact information for many of them and is asking for help to reach the owners. Worth watching: whether hosting providers and CDNs start proactively scanning for this, because the current process clearly isn't working.