/
Navigation
Chronicles
Browse all articles
Explore
Semantic exploration
Research
Entity momentum
Nexus
Correlations & relationships
Story Arc
Topic evolution
Drift Map
Semantic trajectory animation
Posts
Analysis & commentary
Pulse API
Tech news intelligence API
Browse
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
Concept Search
Semantic similarity search
High Impact Stories
Top coverage by position
Sentiment Analysis
Positive/negative coverage
Anomaly Detection
Unusual coverage patterns
Analysis
Rivalry Report
Compare two entities head-to-head
Semantic Pivots
Narrative discontinuities
Crisis Response
Event recovery patterns
Connected
Search: /
Command: ⌘K
Embeddings: large
TEXXR

Chronicles

The story behind the story

days · browse · Enter similar · o open

4,200+ websites, including USCourts.gov, UK's NHS services, other government sites were infected with cryptocurrency mining malware via hacked plugin

Biz scrambles to shut down crafty coin crafting operation  —  Thousands of websites around the world - from the UK's NHS and ICO …

The Register Chris Williams

Context & Ripple Effects

This lands mid-wave: Symantec had already logged an 8,500% quarterly surge in cryptojacking through late 2017, driven by point-and-click mining kits built around Coinhive's browser-based Monero miner. Earlier compromises like the surreptitious miners found on Politifact showed individual sites being hit one at a time.

What changed here is scale through a single dependency: one hacked plugin pushed mining code onto 4,200+ sites at once, including USCourts.gov and NHS services — turning a per-site nuisance into a mass infection of high-trust government domains.

First-order effects

  • Every visitor to the infected pages — including users of USCourts.gov and NHS services — had their device's CPU silently diverted to mining Monero until the operator behind the plugin scrambled to shut the operation down.
  • The affected government and public-sector operators face immediate cleanup and questions about how third-party code reached their production sites.

Second-order effects

  • Site operators are pushed toward stricter control of embedded scripts — allowlists, subresource integrity, and miner-blocking extensions — because any single trusted plugin becomes a distribution channel for thousands of domains.
  • Browser vendors and ad-blockers gain pressure to treat drive-by miners as malware by default, squeezing the economics of legitimate-looking mining services like Coinhive.

Third-order effects

The trend: Cryptojacking is evolving from opportunistic single-site injections into supply-chain attacks that weaponize shared infrastructure — plugins, routers, credentials — to harvest compute at scale.

Discussion

  • @zittrain Jonathan Zittrain on x
    You'd think you could trust the web site of, say, the U.S. court system. But it and thousands of other sites have been infected by drawing from third-party libraries on the fly — ready to use visitors' PC power to mine cryptocurrency: http://scotthelme.co.uk/... @scott_helme
  • @troyhunt Troy Hunt on x
    Statement from @texthelp on the compromise of their script (which was then embedded into a heap of other sites) http://www.texthelp.com/...
  • @mor10 Morten Rand-Hendriksen on x
    Two immediate thoughts: 1. Site owners + devs have a duty of care to end-users to protect from or clearly disclosing cryptocurrency mining scripts. 2. The service at the heart of all this needs #ethics review + independent audit. http://scotthelme.co.uk/... @scott_helme
  • @hrbrmstr @hrbrmstr on x
    Why pwn thousands of sites directly when you can pwn the JS CDN they rely on? // Protect your site from Cryptojacking with CSP + SRI http://scotthelme.co.uk/...
  • @scott_helme Scott Helme on x
    I've written up the story surrounding the cryptojacking problems we've seen hit thousands of sites today: http://scotthelme.co.uk/...
  • @scott_helme Scott Helme on x
    The script tags on http://scotthelme.co.uk/, http://report-uri.com/ and http://securityheaders.io/ all have the integrity attribute on them. You don't want your CDN to be able to compromise you like this. Go and enable SRI and enforce it with CSP. http://scotthelme.co.uk/...
  • @troyhunt Troy Hunt on x
    Gov website crypto miner issue was supply chain compromise. Lack of web security fundamentals (SRI & CSP) made it possible. Was literally “let an external partner run anything on our site & don't tell us when it goes wrong”. Here's @Scott_Helme's writeup: http://scotthelme.co.uk/…
  • @scott_helme Scott Helme on x
    Here's a list of 4,275 sites that are most likely *all* victims: https://publicwww.com/... ealoud.com%2Fplus%2Fscripts%2Fba.js/ ... These sites have neglected to deploy SRI and CSP, which would have completely mitigated this attack.
  • @charlesarthur Charles Arthur on x
    Holy heck this thread. Javascript cryptominers all over the shop. http://twitter.com/...
  • @scott_helme Scott Helme on x
    Let's also clear something else up: As terrible as it is that a crypto miner was injected into all of these sites, in reality, this could have been catastrophically worse. Key loggers, malware, DDoS scripts, BeEF hooks, or, all of the above and more...