Magecart
If you spot an unfamiliar domain in your network traffic, you might open it in a browser and see what it is. Do that with chatshield.org and you land on a non-profit that protects children from grooming and harassment online, a noble cause. It has a 24/7
ClickFix
A macOS ClickFix kit we pulled apart skips all of its own bot and admin checks if you add ?force_fake_captcha=1 to the URL. I guess even malware authors need to test their code too! Debug Mode Every developer has written something like this at some point: if
Magecart
We’ve been tracking a Magecart skimming kit that steals card details by replacing a shop’s payment option with a fake form styled to look like Stripe’s. Pick a payment option at checkout and, on an infected shop, the box under it is quietly replaced with a new
JavaScript Integrity Monitoring
A defunct e-commerce analytics startup let its domain expire and someone re-registered it. With the tag still sitting on online stores, it now hijacks visitors, sells them on to ad networks, and in one case, it delivers a full iOS exploit chain and spyware implant. The issue is
Newsletter
September was about making Report URI easier to start with, easier to pay for and more useful before you've signed up at all. Here's everything we shipped. Start a trial without a card 💳 If you're subscribing to Report URI for the first time, you
ClickFix
On 7th October our Threat Intelligence pipeline flagged a script from ohhhhhmoney.com injected into compromised WordPress sites. It is a ClickFix kit, and at the end of the chain is a backdoored copy of a real desktop app. Its Command and Control (C2) server moves to a new domain
InfoStealer
Yesterday, we traced a single domain from an external threat feed through an extensive delivery chain: compromised WordPress sites, a fake reCAPTCHA challenge and a macOS cryptocurrency stealer delivered from infrastructure operated by a sanctioned Russian hosting provider. Here’s the walkthrough. The starting point At Report URI, we subscribe
DBSC
Since 1st September 2026, every single login to Report URI has been offered a Device Bound Session Credential. That's 100% of our users, on the live site, all day, every day. As far as we can tell, this makes Report URI one of the first production deployments of
Magento
Magento 2 has shipped with Content Security Policy enabled by default since version 2.3.5. On current releases, most pages use a report-only policy, while payment pages use an enforced policy by default. Magento does not, however, know where to send violation reports unless you configure an endpoint.
XSS
A domain we'd never seen before, sb1es.com, popped up in our CSP threat-intel feed recently. It was flagged as a code/exfil hit against a customer site, and it looked like it might be a Magecart skimmer at first glance, so I started investigating. It turns
XSS
Just last week, Dependabot alerted us to CVE-2026-73295, a DOM-based XSS in Material for MkDocs, the theme behind docs.report-uri.com. Dependabot opened the bump for us overnight, so it was a simple enough fix, but I was curious what the impact was. It turns out
Newsletter
August was the month a couple of long-running betas finished, and the month we started publishing the research that sits behind the product. Here's everything we shipped. Connection Allowlist is out of beta 🔌 Chrome 152 went stable on 25th August with Connection Allowlists shipped to desktop, Android