Web skimming is a browser-side attack in which malicious script captures payment or form data as a user submits it. The attacker injects code into a legitimate page, often through a compromised script or plugin, then exfiltrates the data before it reaches the payment processor.
Expanded Definition
Web skimming is a form of client-side theft that targets the browser execution path rather than the backend payment stack. The malicious code runs in the victim’s page context, intercepting keystrokes, field values, or form submissions after the page has loaded but before data is sent to the intended destination. That makes it especially difficult to notice through traditional server logs alone.
Unlike classic server compromise, web skimming often depends on trust in third-party scripts, tag managers, plugins, or compromised content delivery paths. The attacker does not need to own the whole site if they can alter a single script chain that executes in the browser. For security teams, the distinction matters because remediation usually spans application security, content integrity, payment workflows, and third-party risk management. Guidance continues to evolve across vendors on how broadly to classify related client-side attacks, but the core concept is stable: data is stolen in the browser at the moment of user interaction. The most common misapplication is treating web skimming as a payment processor issue, which occurs when defenders overlook browser-delivered code and focus only on backend transaction systems.
Examples and Use Cases
Implementing strong web-skimming defenses often introduces development and operations friction, requiring organisations to balance script flexibility against tighter content controls and monitoring.
- A compromised analytics tag injects JavaScript that copies checkout card data and posts it to an attacker-controlled endpoint.
- A malicious plugin or extension on a merchant site modifies a contact form so submitted personal data is duplicated before submission.
- A supply-chain compromise alters a shared JavaScript library used across multiple pages, affecting any page that loads the tainted asset.
- A fraud team detects unusual outbound requests from a checkout page and correlates them with a recent script change that bypassed review.
- A security team uses NIST Cybersecurity Framework 2.0 to structure monitoring, change control, and incident response around browser-delivered threats.
These examples show why web skimming is not limited to retail payments. Any page that collects sensitive form data can become a target if its active content is not tightly governed.
Why It Matters for Security Teams
Web skimming exposes a blind spot in many security programs because the theft happens inside the user session, where perimeter tools and backend-only controls provide limited visibility. When organisations rely on third-party JavaScript, tag managers, or loosely governed plugins, they inherit a live execution risk that can change without a full application release. This makes integrity monitoring, script allowlisting, dependency review, and rapid containment essential parts of defensive practice.
The identity and privacy impact can be significant. Stolen form data may include credentials, payment details, addresses, or other personal information, creating downstream fraud and compliance obligations. For teams working in digital commerce or identity verification, web skimming is a reminder that trust in the browser must be actively managed, not assumed. Organisations typically encounter the operational consequences only after carding abuse, customer complaints, or regulator scrutiny surface the compromise, at which point web skimming becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS-6 | Integrity of data in transit and at rest is threatened when browser scripts steal form inputs. |
Protect sensitive form flows with integrity checks, monitoring, and controlled script delivery.
