Formjacking

Formjacking is the injection of malicious JavaScript into a legitimate website so that data entered into its forms — payment card numbers, logins, personal details — is silently copied to an attacker as the user types or submits. The page is real, the padlock is real, and the purchase usually completes normally; the victim has no signal that anything was stolen. Because the classic target is the checkout page, formjacking is also called web skimming or e-skimming, and the loose network of criminal groups that industrialized it against e-commerce platforms is known collectively as Magecart.

How it works

The attacker needs to get one script onto the page. Sometimes that means compromising the site itself through stolen admin credentials or an unpatched plugin. At least as often it is a supply chain attack: compromising a third-party component the site already loads — a tag manager, analytics snippet, chat widget, or CDN-hosted library — so that one poisoned script lands on every site that embeds it. The skimmer then watches form fields and exfiltrates captured values to an attacker domain, often obfuscated and conditioned to run only for real visitors. High-profile incidents at major airlines and ticketing platforms in 2018 showed the scale: a few lines of injected script, millions of affected customers, and some of the era's largest data-protection fines.

For businesses, the exposure is twofold: your customers' data if your own site is skimmed, and your employees' credentials when the forms they fill on third-party portals — suppliers, benefits providers, booking tools — are compromised, a risk dimension covered in our guide to third-party and vendor human risk.

How to defend against it

Site owners should inventory and minimize third-party scripts, enforce a Content Security Policy and Subresource Integrity so unauthorized or altered scripts fail to load, and monitor for unexpected outbound requests from payment pages. Protect the human entry points attackers use to plant skimmers — admin credentials and CMS access — with phishing-resistant MFA and defenses against credential harvesting. For everyone else, prefer saved payment methods or wallet services over retyping card numbers, and treat unexpected payment failures or duplicate charge patterns as reasons to check statements.