Full Report
The Wikimedia Foundation suffered a security incident today after a self-propagating JavaScript worm began vandalizing pages and modifying user scripts across multiple wikis. [...]
Analysis Summary
# Incident Report: Wikimedia Foundation Self-Propagating JavaScript Worm
## Executive Summary
The Wikimedia Foundation experienced a security incident caused by a self-propagating JavaScript worm that leveraged user-script functionality to vandalize pages and hijack user accounts. The worm spread by modifying global and user-specific JS files, resulting in nearly 4,000 modified pages before being contained by Wikimedia engineers. Editing was temporarily restricted globally to allow for the suppression of malicious code and restoration of affected scripts.
## Incident Details
- **Discovery Date:** March 5, 2026
- **Incident Date:** March 5, 2026 (Initial script uploaded March 2024)
- **Affected Organization:** Wikimedia Foundation (Wikipedia)
- **Sector:** Non-profit / Information Technology / Media
- **Geography:** Global (Russian Wikipedia identified as the initial source)
## Timeline of Events
### Initial Access
- **Date/Time:** March 5, 2026, approx. 03:42 PM (Detection/Reporting)
- **Vector:** Execution of a dormant malicious script via a privileged account.
- **Details:** A script hosted at `User:Ololoshka562/test.js` (uploaded in 2024) was executed by a Wikimedia employee account, possibly during testing of user-script functionality.
### Lateral Movement
- The worm used the session and privileges of the logged-in user to overwrite `User:[username]/common.js`.
- If the user possessed administrative privileges, the worm modified the site-wide `MediaWiki:Common.js`, allowing it to execute for every visitor/editor on the wiki.
### Data Exfiltration/Impact
- **Vandalism:** Approximately 3,996 pages were modified with hidden script loaders and images.
- **Account Hijacking:** Roughly 85 users had their personal `common.js` files replaced with malicious loaders.
- **Resource Abuse:** The script utilized `Special:Random` to automate the discovery and defacement of pages.
### Detection & Response
- **Discovery:** Editors noticed automated edits and reported the activity on Wikipedia's "Village Pump (technical)" forum.
- **Response actions:** Engineers restricted editing site-wide, rolled back malicious edits, and suppressed infected page histories to prevent further execution.
## Attack Methodology
- **Initial Access:** Execution of a pre-existing malicious script (`test.js`) by a privileged user.
- **Persistence:** Injection of JavaScript loaders into user-specific `common.js` files and site-wide `MediaWiki:Common.js`.
- **Privilege Escalation:** Leveraged the existing permissions of the victim account (Employee/Admin) to modify protected global files.
- **Defense Evasion:** Hidden JavaScript loaders were embedded within page edits (e.g., hidden in image tags or comments).
- **Credential Access:** Not applicable; the worm used active browser sessions/cookies rather than stealing passwords.
- **Discovery:** Automated use of `Special:Random` to find new targets for vandalism.
- **Lateral Movement:** Automated cross-site scripting (XSS) propagation between user accounts and site-wide configurations.
- **Collection:** N/A.
- **Exfiltration:** N/A.
- **Impact:** Mass vandalism, disruption of service (edit lockdowns), and modification of system-wide UI scripts.
## Impact Assessment
- **Financial:** Undisclosed (costs associated with engineer response time).
- **Data Breach:** Compromise of 85+ user configuration scripts; integrity of 3,996 pages.
- **Operational:** Temporary global restriction on editing; manual rollback of thousands of changes.
- **Reputational:** Public notice of the vulnerability in the platform's script-handling architecture.
## Indicators of Compromise
- **Network indicators:** Requests to hxxps[://]basemetrika[.]ru/s/e41
- **File indicators:** Modified `common.js` files containing `$.getScript` calls; hidden scripts in `[[File:Woodpecker10.jpg]]`.
- **Behavioral indicators:** Automated edits adding `[[#%3Cscript%3E...%3C/script%3E]]` to random articles.
## Response Actions
- **Containment:** Temporarily disabled editing across multiple wiki projects.
- **Eradication:** Reverted and "suppressed" (hidden from history) all edits related to the worm.
- **Recovery:** Mass rollback of `User:/common.js` and restoration of `MediaWiki:Common.js` to a known good state.
## Lessons Learned
- **Key takeaways:** Dormant scripts in user namespaces can remain a threat long after creation; administrative accounts are high-value targets for XSS-based worms.
- **What could have been done better:** Stricter sandboxing or review processes for scripts executed by employees in production environments.
## Recommendations
- **Content Security Policy (CSP):** Strengthen CSP headers to restrict the loading of JavaScript from untrusted external domains.
- **Input Validation:** Implement stricter validation for `common.js` modifications to detect self-propagating patterns.
- **Privileged Access Management:** Require additional verification for modifications to global system files like `MediaWiki:Common.js`, even for authenticated admins.