Browsealoud script delivered Coinhive miner

Browsealoud was a third-party accessibility script. Thousands of sites loaded ba.js from Texthelp, including public-sector and government pages. On February 11, 2018, that shared script became the delivery point.

The altered file wrote Coinhive mining JavaScript into pages that included it. Visitors did not lose money or credentials, but their browsers performed cryptocurrency mining for the attacker, burning CPU, battery, and trust.

Texthelp took Browsealoud offline after the compromise was reported. The NCSC used the incident to point administrators toward a simple lesson: third-party JavaScript executes with the authority of the page that includes it.

The defenses were old and still neglected. Subresource Integrity can pin a static script to a known hash. Content Security Policy can constrain where code may load from. Without those checks, one supplier file became code running across thousands of unrelated sites.