Scott Helme
@scotthelme.bsky.social
Hi, I'm Scott Helme, a Security Researcher, Entrepreneur and International Speaker. I'm the creator of Report URI and Security Headers, and I deliver world renowned training on Hacking and Encryption. https://scotthelme.co.uk
I can't claim to have come up with the cool name for this malware, this is what the attackers called it themselves! 🤷♂️ blog.report-uri.com/superpixel-t...
SuperPixel: The Card Skimmer Hiding Inside Your Own jQuery
We've uncovered a new card-skimming campaign affecting more than 100 online shops so far, and the attackers are hiding their malware somewhere you might never think to look: inside the website's own…
blog.report-uri.com
I dug into the ~$2.6M Polymarket crypto theft. The attackers replaced a third-party JS file with targeted malware by compromising the performance monitoring tool DebugBear. We can't keep blindly loading and running other people's code with no checks in place!! blog.report-uri.com/polymarkets-...
Polymarket's CSP Allowed Every Part of the $2.6 Million Crypto Theft
For about fifty minutes on Thursday afternoon, a performance monitoring script loaded on polymarket.com was compromised and started quietly emptying the accounts of anyone it targeted. It walked off…
blog.report-uri.com
€120 cleaning fee on a 3 night stay and we got this from our host, I’m glad AirBnB stepped in. We started the dishwasher on departure (obviously couldn’t empty) and no, I didn’t take out the trash. Paying premium prices, then paying a cleaning fee, then doing the cleaning? Nope! 🤷♂️
"Sorry we didn't get back to you yet, we've been too busy on Twitter and trying to keep our investors happy" Unbelievable statement from eMudhra! bugzilla.mozilla.org/show_bug.cgi...
eMudhra claim they're leaving the SSL/TLS business because they're being criticised on social media. It's more likely that they've realised they will probably be fully removed anyway, so they're bowing out now. emudhra.com/en/press-rel...
This escalated really quickly and I can't believe we ended up in a rabbit hole of tearing apart DarkSword exploit kits!
Report URI@report-uri.bsky.social · 2w agoForgotten website tags are being turned into spyware delivery routes. Working with iVerify, we traced DeadTag: 660+ hijacked domains, thousands of sites, and traffic feeding the Coruna and DarkSword iPhone exploit kits. The investigation: blog.report-uri.com/deadtag-how-...
What an utterly terrifying, yet completely fair, question to ask of eMudrah. bugzilla.mozilla.org/show_bug.cgi...
-----BEGIN EC PRIVATE KEY----- 4 -----END EC PRIVATE KEY----- 😬
Here's everything we've done so far for @reporturi in response to php2shell. Feedback and suggestions welcome 👍
Report URI@report-uri.bsky.social · 2w agoTwo critical PHP vulnerabilities leaked ahead of the scheduled patch. We disabled session upload progress, blocked multipart requests at the edge, and confirmed Cloudflare’s new WAF mitigations were in place. Our response to php2shell so far: blog.report-uri.com/responding-t...
Damn, this is really bad. Mainstream browsers will probably be fine, but there is a long tail of other stuff that will be affected by this: scotthelme.co.uk/eight-bits-o...
Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
One of eMudhra's certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and…
scotthelme.co.uk
If passkeys have people this upset, wait until they hear about DBSC 🤣 Your session is hardware bound to your device... Somewhere, a cookie just found out it can be device-bound 🍪🔐 scotthelme.co.uk/device-bound...
Device Bound Session Credentials: Making Stolen Cookies Useless
A stolen session cookie can be vastly more powerful than a stolen password. The attacker doesn’t need to phish the user, bypass MFA, or defeat their passkey; they simply replay the cookie and step…
scotthelme.co.uk
Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack. The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation. I’ve written a rebuttal: scotthelme.co.uk/passkeys-are...
Passkeys Are Not a Trap
A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this…
scotthelme.co.uk
Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack. The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation. I’ve written a rebuttal: scotthelme.co.uk/passkeys-are...
Passkeys Are Not a Trap
A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this…
scotthelme.co.uk
Making space to add more AI 😎 I’ve got my UniFi AI Key that does analysis on my CCTV cameras, a Mac Mini M4 that’s now maxed out, and a Mac Mini M5 Pro on the way! 🤖 This little rack is quite cool to hold them all with space for ventilation 🔥
I remember DEF CON 23 (2015!) when Let's Encrypt was getting ready to launch. They shocked the industry and cemented 90-day certificates as the new norm. Now, 10+ years later, they're reducing the default validity period on their certificates for the first time. scotthelme.co.uk/the-first-re...
The First Reduction in Their History: 64-Day Let's Encrypt Certificates
I remember being in the room at DEF CON 23 in Las Vegas, in 2015, listening to "Let's Encrypt – Minting Free Certificates to Encrypt the Entire Web". It was still months before Let's Encrypt would lau...
scotthelme.co.uk
This ClickFix lure is served from ohhhhhmoney[.]com That's probably the most interesting domain I've seen 😅 There's a list of all the IOCs in the blog post 👍
Report URI@report-uri.bsky.social · 4w agoA fake CAPTCHA, a trojanised file manager and a new C2 domain every Thursday. We traced a ClickFix campaign and recovered its DGA, letting us predict future C2 domains. Here’s the attack chain and the IOCs defenders can use 👇 blog.report-uri.com/a-fake-captc...
My best image capture yet! 📸 METEOR-M2-3 (NORAD 57166) 🛰️ The forecast isn't looking great for later this afternoon 😅
A bunch of these domains went from first registration to being flagged in our threat intel feed in just 30 hours! There's a massive IoC list at the end of the post 💪
Report URI@report-uri.bsky.social · last mo.One suspicious domain led us to 2,000+ compromised WordPress sites, a fake reCAPTCHA lure and a macOS infostealer targeting crypto wallets, browser cookies and Keychain data. We traced the campaign to sanctioned Russian infrastructure and published the IOCs: blog.report-uri.com/chasing-a-cl...
It's pretty awesome to have this rolled out to 100% of users already!! 🤩
Report URI@report-uri.bsky.social · last mo.We’ve rolled out Device Bound Session Credentials to 100% of Report URI logins. 🔐 67.7% of our active sessions are already device-bound, making this what we believe to be one of the first production DBSC deployments outside Google. Here’s how we did it: blog.report-uri.com/we-rolled-ou...
It's so cool when you see something you built working exactly as intended 😎
Report URI@report-uri.bsky.social · 2mo agoWe deployed an update at 14:00 UTC that introduced a new JavaScript dependency. At 14:04 UTC, Script Watch alerted us to it. That is the visibility you need in the browser: know when new code appears on your site, whether the change is expected or not. Four minutes from deployment to detection! ⏱️
If you want a free @report-uri.bsky.social account during the beta, and then 50% off your first year as a thankyou, check out our new Magento CSP module in beta! 😎
Report URI@report-uri.bsky.social · 2mo agoMagento has shipped with CSP enabled by default since 2.3.5, but most stores never configure a reporting endpoint. We found 2,236 Magento sites taking card payments with this exact gap, so we built a free module to fix it: blog.report-uri.com/magento-alre...
Great bit of research here from @scotthelme.bsky.social who decided to put a hacking group's story to the test. The criminals who hacked the three UK airports boasted about how easy it was and Scott checked the receipts. Apparently it was EXTREMELY basic stuff: scotthelme.co.uk/no-hacking-r...
No Hacking Required: The Manchester Airports Group Data Breach
On 27 August 2026, Manchester Airports Group told customers that "an unauthorised third party" had stolen their data. Car park bookings, lounge bookings, Fast Track purchases for airport security and ...
scotthelme.co.uk
They exposed data on 8.8 million people with no exploit, no malware, and no access to MAG’s servers. Three server-side API keys sat in public JavaScript for 4+ years and FulcrumSec found them. They could have modified and deleted data too. scotthelme.co.uk/no-hacking-r...
No Hacking Required: The Manchester Airports Group Data Breach
On 27 August 2026, Manchester Airports Group told customers that "an unauthorised third party" had stolen their data. Car park bookings, lounge bookings, Fast Track purchases for airport security and…
scotthelme.co.uk
OK, it's not brilliant and the setup needs some work, but I got my first real data down from the weather satellite this morning! It's a homemade antenna on the roof, into a £40 dongle and a raspberry pi. The satellite was METEOR-M2 3, 838 km overhead(!), on 137.9 MHz.
AOS!!! Weather satellite image download, first attempt. 137.9 MHz — Meteor-M N2-4 Dipole antenna @ 120°, aimed north Raspberry Pi 4B + £40 USB dongle Thirteen minutes as it passes 800 km overhead. No idea yet whether it'll work...
How can you possibly know your website is secure if you don’t know what code is actually running in your users’ browsers?! It seems like such a basic question, but most organisations simply can’t answer it. Now you can!
Report URI@report-uri.bsky.social · 2mo agoDo you know exactly what JavaScript ran in your users’ browsers? We fingerprint every executed script, alert when something changes and preserve a verified copy for investigation. Zero code on your page. blog.report-uri.com/we-can-prove...
🚀 Connection Allowlist is now in open beta at Report URI! Build an egress firewall directly into the browser: control where pages can connect, block unauthorised destinations and detect attempted data exfiltration. Learn more and try it now 👇 blog.report-uri.com/connection-a...
Connection Allowlist: an egress firewall for the browser
Until now, malicious code running in a browser has had several ways to send data somewhere it shouldn’t, including new channels that CSP cannot fully cover and channels that do not even appear in the ...
blog.report-uri.com
