Ummm, so yeah, this is *bad*. I just had @phat_hobbit point out that @ICOnews has a cryptominer installed on their site... 😮 
It's on all of the pages I've checked so far too: 
Confirmed it's not just me seeing this: webpagetest.org/result/180211_… 
Ok so this is via a 3rd party compromise, here is the script: browsealoud.com/plus/scripts/b…
Hey @texthelp you've been compromised, you need to address this ASAP. Their site also has the crypto miner running: 
It's also on @uscourts! 
The Student Loan Company here in the UK: 
The General Medical Council: 
The NHS is directly affected too: 
So many *government* websites in the UK are running a crypto miner *right now*... 
Hey @troyhunt, even you're hit down under... 
I have a list of over 20 .gov.uk .nhs.uk and .ac.uk domains affected so far. Seems to have hit other government sites too including the US and Australia.
Here's a list of 4,275 sites that are most likely *all* victims: publicwww.com/websites/brows…
These sites have neglected to deploy SRI and CSP, which would have completely mitigated this attack.
These sites have neglected to deploy SRI and CSP, which would have completely mitigated this attack.
For those wondering if sites can protect themselves against a 3rd party compromise like this, the answer is yes, easily. I have articles on CSP and SRI which would protect you:
scotthelme.co.uk/content-securi…
scotthelme.co.uk/subresource-in…
scotthelme.co.uk/content-securi…
scotthelme.co.uk/subresource-in…
We recently launched our own library for @reporturi and we never want to be an attack vector used against our customers that include our script. To protect our customers we provide script tags with SRI attributes present. report-uri.github.io/report-uri-js-…
see thread.
The Student Loans Company is now back online with the offending script removed: 
