Report URI

08/10/2026

A fake CAPTCHA, a trojanised file manager and a new C2 domain every Thursday.

We traced a ClickFix campaign and recovered its DGA, letting us predict future C2 domains.

Here’s the attack chain and the IOCs defenders can use 👇

On 7th October our Threat Intelligence pipeline flagged a script from ohhhhhmoney.com injected into compromised WordPress sites. It is a ClickFix kit, and at the end of the chain is a backdoored copy of a real desktop app. Its Command and Control (C2) server moves to a new domain

23/09/2026

One suspicious domain, that's all we had to start with.

Following it led us to more than 2,000 compromised WordPress sites, a fake reCAPTCHA challenge and a macOS infostealer targeting cryptocurrency wallets, browser cookies and the macOS Keychain.

The campaign works hard to avoid inspection. It filters crawlers and security tools, fingerprints visitors, targets only macOS devices and shows each victim the lure just once.

By combining external threat intelligence with Report URI’s crawler data and global browser telemetry, we were able to trace the delivery chain, analyse the payload and expose infrastructure operated by a sanctioned Russian hosting provider.

We’ve published the full investigation, defensive guidance and a complete IoC list:

Yesterday, we traced a single domain from an external threat feed through an extensive delivery chain: compromised WordPress sites, a fake reCAPTCHA challenge and a macOS cryptocurrency stealer delivered from infrastructure operated by a sanctioned Russian hosting provider. Here’s the walkthrough....

18/09/2026

Report URI CSP alerts surfaced a ClickFix campaign on compromised e-commerce sites using Base64 loaders and a fake verification overlay.

16/09/2026

We deployed an update at 14:00 UTC that introduced a new JavaScript dependency.

At 14:04 UTC, Script Watch alerted us to it.

That is the visibility you need in the browser: know when new code appears on your site, whether the change is expected or not.

Four minutes from deployment to detection! ⏱️

04/09/2026

Our logo's in good company this weekend. 🏁

Will Orton & Jessica Hawkins go into Donington Park leading British GT4! 😎

Proud to back the #21 Aston Martin MK Racing

03/09/2026

Do you know exactly what JavaScript ran in your users’ browsers?

We fingerprint every executed script, alert when something changes and preserve a verified copy for investigation.

Zero code on your page.

Right now, on our own production site, I can tell you the cryptographic fingerprint of every single JavaScript file that executed in a real visitor's browser this month. Not what our build system produced. Not what our CDN thinks it's serving. What actually ran, in the wild, on

04/08/2026

ClickFix tricks users into compromising their own machines and hides its payload on a blockchain.

But the attack still begins the same way: a website runs JavaScript it was never meant to run.

That’s where we could have stopped it.

A customer forwarded us something last week that has stuck with me. It was a live attack campaign — a good one, in the professional-admiration sense — along with a detailed public write-up dissecting exactly how it worked. The analysis was genuinely impressive. It traced the whole thing from the

28/07/2026

Stripe just made CSP a compliance requirement.

Merchants completing their annual PCI assessment are now asked to attest that they’ve deployed a Content Security Policy.

That’s a major shift from “you should deploy CSP” to “confirm that you have.”

Here’s what changed and why it matters:

Stripe's PCI assessment now has a mandatory checkbox: confirm you've deployed a Content Security Policy. Here's what you're attesting to, and how to do it.

23/07/2026

Onboarding just got a whole lot easier! 🤖

Using Claude, ChatGPT, Gemini, or another AI agent?

Login, click "Copy Prompt", paste it into your AI, and it'll configure CSP reporting for you.

Get up and running in minutes 😎
https://report-uri.com/

20/05/2026

We’ve open-sourced passkeys-php, the WebAuthn library we use at Report URI, to help the community deploy passkeys more easily and safely.

Small. Auditable. MIT licensed. Built for real-world PHP apps.

Our founder, Scott Helme, shared the details today:

We've open-sourced passkeys-php, the WebAuthn server library we use at Report URI to protect logins with passkeys, security keys, and platform authenticators like Touch ID, Face ID, and Windows Hello. It started as a set of local security fixes for our own production passkeys implementation. Now, ra...