Compromised Browsealoud script turned government websites into Monero miners

A compromised accessibility script caused government and institutional websites to make visitors’ browsers mine Monero on February 11, 2018. The incident was not a breach of thousands of sites one by one. It was a supply-chain compromise: attackers altered a JavaScript file served by Browsealoud, so every page that trusted and loaded that file could inherit the unwanted mining code.

British security researcher Scott Helme documented the event as it unfolded. After an antivirus warning appeared on the website of the United Kingdom’s Information Commissioner’s Office, Helme traced the miner away from the regulator’s own servers and into Browsealoud’s hosted ba.js library. He decoded an added document.write instruction that loaded Coinhive and started a browser-based miner. His February 11 search of PublicWWW showed more than 4,000 sites referencing the affected file, including the U.S. Courts, the U.K. Student Loans Company, the General Medical Council and National Health Service sites.

One altered dependency, thousands of exposures

The U.K. National Cyber Security Centre confirmed that the Browsealoud compromise occurred on February 11, 2018. Its event-day guidance said visitors to sites embedding the library inadvertently ran computationally intensive code that generated cryptocurrency for the attackers. The NCSC said the code did not take money from visitors; its observed user impact was temporary performance loss and reduced battery life.

That distinction matters. “More than 4,000” was a discovery count of pages or sites loading the library in Helme’s contemporaneous search, not a count of unique people whose computers performed mining work. The surviving public record does not provide verified visitor totals, hash rate, electricity consumed, Monero produced or proceeds received by the attacker. Nor did the evidence available on February 11 establish the attacker’s identity or explain exactly how the hosted file was modified.

Texthelp, the company behind Browsealoud, took the service offline on February 11. In a company statement reported by Ars Technica, Texthelp said the compromised version operated for about four hours and that no customer data had been accessed or lost. Those were contemporaneous company claims, not an independently published forensic audit. The shutdown stopped sites from pulling the tainted library without requiring each customer to patch its own page immediately. Camden Council, one affected public body, subsequently said Browsealoud’s removal disabled the software on its site and emphasized that the issue lay in the third-party tool rather than a direct compromise of Camden’s website.

Why the crypto angle mattered

Coinhive made it possible to mine Monero through JavaScript running inside an ordinary browser tab. In a legitimate deployment, that model could be presented as an alternative to advertising. Here, visitors received neither a meaningful choice nor a benefit: their processors were used to create value for an unknown party while they accessed public services.

The episode therefore joined cryptocurrency economics to a familiar software-security weakness. A small mining return could still motivate an attacker when the computing hardware and electricity belonged to other people and distribution came through a trusted dependency. More importantly, the altered script demonstrated that access obtained for mining could have delivered other browser-executed code. The verified event was cryptojacking, but the institutional lesson extended beyond Monero.

The event-day security lesson

Helme identified Subresource Integrity as a direct defense for a stable third-party file: a website could specify the expected cryptographic hash and cause a browser to reject a modified script. He also pointed to Content Security Policy as a way to restrict where scripts could load from and where they could connect. The NCSC’s February 11 guidance likewise recommended risk-based review of third-party JavaScript, local hosting where practical, SRI for relatively static files, CSP, stronger change controls and rapid takedown procedures.

The compromise was consequential not because a verified fortune was mined—the public evidence establishes no such amount—but because one altered accessibility dependency silently converted trusted public websites into cryptocurrency-mining distribution points.