Loading story…
Wikipedia’s English-language community moved to deprecate and spam-blacklist Archive.today (including related domains such as archive.is and archive.ph) and begin removing its links across the encyclopedia after allegations that the service “hijacks users’ computers” to participate in a distributed denial-of-service (DDoS) attack. Editors cited reports that visitors to Archive.today’s CAPTCHA page unknowingly executed JavaScript that generated requests to blogger Jani Patokallio’s Gyrovague site, allegedly to drive up hosting costs and force attention; Wikipedia discussions referenced this behavior as incompatible with external-linking policies and initiated steps to block new links and remove existing ones.
During the deprecation discussion, editors also raised integrity concerns, citing evidence that Archive.today altered archived snapshots—including inserting references to the targeted blogger—undermining the service’s reliability as a citation source. The decision affects a large footprint on Wikipedia (reported as ~695,000 links across roughly ~400,000 pages), with editors noting that many uses can be replaced by other archives; Ars Technica also reported that Archive.today is subject to an investigation in which the FBI is attempting to identify the site’s founder/operator, whose identity has been described as opaque.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
The apparent Archive.today owner rejected parts of the media characterization, defended the service’s role for Wikipedia, and said they would "scale down the 'DDoS'."
Wikipedia editors decided to deprecate Archive.today and related domains, add them to the spam blacklist, and begin removing or replacing roughly 695,000 archive links. Editors were instructed to use original sources or alternatives such as the Internet Archive’s Wayback Machine.
Reports and editor discussions alleged that some Archive.today captures had been modified, raising doubts about the service’s reliability as a citation source for Wikipedia.
On January 11, 2026, Patokallio reported that visitors loading Archive.today’s CAPTCHA page unknowingly executed JavaScript that sent search requests to his Gyrovague blog, forming an apparent DDoS-like campaign.
In 2023, blogger Jani Patokallio investigated Archive.today and described its ownership as opaque, speculating that it was likely operated by a technically skilled Russian individual with access to infrastructure in Europe.
Wikipedia had previously un-blacklisted Archive.today in 2016, allowing its links to be used on the platform again. This earlier decision was later reversed in 2026.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Wikimedia Foundation** responded to a security incident in which a **self-propagating JavaScript worm** vandalized pages and modified user scripts across multiple wiki projects, including **Wikipedia**. Editors reported waves of automated edits that inserted hidden JavaScript loaders and random vandalism, prompting Wikimedia engineers to **temporarily restrict editing** while investigating and reverting malicious changes. Reporting indicates the outbreak began after a malicious script hosted on Russian Wikipedia (notably `User:Ololoshka562/test.js`, previously uploaded and allegedly tied to earlier wiki attacks) was executed, leading to infection of both user-level and global JavaScript. The worm propagated by injecting loaders into `User:<username>/common.js` and the global `MediaWiki:Common.js`, enabling it to run in other editors’ browsers and spread further when accounts with sufficient privileges were affected. Approximately **3,996 pages** were modified and about **85 users** had their `common.js` overwritten before containment actions and mass reverts began; it remains unclear whether the initial execution was accidental testing activity, intentional, or the result of account compromise.
Jun 29, 2026
Internet Archive confirmed a breach that exposed data tied to **31 million user accounts** after attackers displayed a malicious JavaScript pop-up on the site announcing the intrusion. According to reporting validated by security researcher Troy Hunt and others, the stolen data dated to September 2024 and included **email addresses, screen names/usernames, bcrypt password hashes, and other system data** from the organization's digital library platform. The disclosure unfolded as Internet Archive was also contending with **intermittent distributed denial-of-service attacks** that disrupted availability and a site defacement linked to a compromised JavaScript library. Founder Brewster Kahle said security upgrades were underway; hacktivist group **BlackMeta** claimed responsibility for the DDoS activity, while the actor behind the underlying data theft was not identified. The breach was later cataloged by Have I Been Pwned as affecting 31 million records.
Jun 29, 2026
WikiLeaks repeatedly faced disruption tied to high-profile disclosures, including attacks on its infrastructure and government-imposed access restrictions. In one earlier episode, the organization struggled to keep its site online as opponents targeted its domain and hosting arrangements, forcing it to shift providers and addresses to stay reachable. Years later, WikiLeaks said it came under a **sustained attack** after announcing plans to publish roughly **300,000 emails** and **500,000 documents** related to Turkey’s political power structure following the failed coup attempt. After the Turkish document release, authorities in Turkey blocked access to WikiLeaks, escalating the confrontation from network pressure to direct censorship. In a separate but related controversy, WikiLeaks supporters claimed responsibility for the massive **Dyn** distributed denial-of-service incident that disrupted major U.S. websites, framing it as retaliation for Ecuador cutting Julian Assange’s internet access, but investigators and security researchers said there was not enough evidence to attribute the attack to them and pointed instead to **Mirai**-driven botnet activity involving internet-connected devices.
Jun 29, 2026