15,579 infected websites found, and most owners ignore the email

15,579 websites are serving malicious JavaScript to their visitors right now, and most of their owners do not know. Security researcher Scott Helme published the number on November 6, from crawling done by his company, Report URI. The infected websites get an estimated 135 million visits a month. The hard part is not finding them. It is telling the owners: Helme says most of his team's emails and messages get no answer.

What actually happened

Per Helme's post:

• The count. 15,579 unique sites are confirmed infected, with thousands more suspected. Sites drop off the list when they clean up, so the real total is higher.
• The payloads. Card skimmers ("Magecart") on payment pages. ClickFix pages that trick visitors into running malware. Redirects to fake login pages and scams. Exploits that target specific iOS versions to install spyware.
• How sites get infected. A hacked CMS such as WordPress, an infected third-party script, cross-site scripting, or "DeadTag." That is Report URI's name for a group that buys expired domains that websites still load JavaScript from, then serves malware from them.
• Who. No global top sites. Many are regional leaders, with a large share in Europe.
• The ask. Helme wants national CERT teams to contact Report URI for lists of infected sites in their countries. He will not publish the list, because it would also be a list of targets.

Why it matters for your business

If your store is on that list, you are probably not going to hear about it. WHOIS contacts are mostly hidden since GDPR. Your host often sits behind a CDN. Few sites publish a security.txt. So the only reliable alarm is one you set yourself.

Do three things this week:

1. List every script your checkout loads. Open your payment page, look at every external domain, and confirm each one is a vendor you still pay. A domain you stopped using is DeadTag bait. Remove the tag, then renew the domain or let it go on purpose.
2. Turn on Content Security Policy reporting. A CSP in report-only mode tells you when your pages load a script from somewhere new. It costs nothing to start and does not block anything.
3. Publish a security.txt. Put a file at /.well-known/security.txt with a contact address someone reads. When a researcher finds a skimmer on your site, they need a way to reach you.

Sources: Scott Helme: We Know 15,579 Websites Are Infected. How Do We Tell Them?.