A client-side attack targets the user’s browser, device, or local application instead of a central server. It exploits code, content, or trust on the endpoint to steal data, run malicious actions, or hijack sessions. Common paths include malicious scripts, document exploits, and browser-based credential theft.
How Client-Side Attacks Work
Client-side attacks shift the security boundary away from a hardened server and onto the user’s browser, desktop, or mobile device. The attacker does not need to break the server first, they need a way to influence what the endpoint loads, executes, or trusts.
That makes the attack surface broad: malicious scripts, poisoned documents, browser extensions, drive-by content, and compromised third-party resources can all become entry points. In practice, the browser is often the execution engine, so anything that can shape page content or local interaction can become a delivery path.
Client-side attacks are especially effective because they exploit normal user workflows. A page can look legitimate, a document can open normally, and a session can be stolen without visibly disrupting the application itself.
Common Client-Side Attack Paths
The most familiar paths are script injection, malicious file payloads, browser-based credential theft, and session hijacking. These attacks may arrive through phishing pages, compromised websites, ad networks, browser supply chains, or a trusted service that has been tampered with upstream.
Some attacks are opportunistic and broad, while others are highly targeted. The browser may be used to capture tokens, read page content, trigger actions on behalf of the victim, or exfiltrate data already visible in the session.
For defenders, the important point is that the “target” is not only the user, but also the trust relationship between the browser and everything it renders. Client-side compromise often becomes a bridge into account takeover, data theft, or lateral abuse of authenticated sessions.
Why Client-Side Attacks Are Hard to Contain
These attacks are hard to contain because they blend into legitimate endpoint activity. A malicious payload can run inside normal browser behavior, inherit the user’s privileges, and evade controls that focus only on server-side validation or perimeter inspection.
Visibility is also weaker on the endpoint than on the server. Security teams may see the outcome, such as suspicious requests or stolen sessions, long after the original page content or document interaction has disappeared.
NHIMG’s The 52 NHI Breaches Report is useful here because many real-world compromise chains show the same pattern of stolen secrets, abuse of trusted credentials, and downstream lateral movement after the initial foothold.
One useful data point is that 30.9% of organisations store long-term credentials directly in code, which shows how often endpoint-adjacent trust paths still expose reusable secrets. That matters for client-side attacks because the browser, local application, or rendered content may surface material an attacker can reuse immediately.
Defensive Implications for Browsers and Endpoints
Client-side security depends on reducing trust in what the endpoint consumes and on limiting the blast radius if a session or local runtime is compromised. The practical focus is on constraining what browser content can execute, what local data can be reached, and how long stolen session material remains useful.
This is why browser hardening, content controls, strong session design, and rapid revocation matter more here than in many server-centric threats. A client-side incident often succeeds because the endpoint was allowed to execute untrusted content inside a trusted context.
For a broader attack-chain view, MITRE ATT&CK Enterprise helps map the follow-on behaviors that often emerge after browser compromise, while CISA cyber threat advisories provide current context on adversary delivery methods and exploitation trends.
For endpoint trust boundaries and session exposure, NIST SP 800-207 Zero Trust Architecture is a strong reference because client-side compromise is exactly the kind of scenario where implicit trust in the device or browser becomes dangerous.
Risk and Threat Considerations
Client-side attacks are risky because they exploit the one place defenders least control, the user’s execution environment. Once the browser or local application is influenced, an attacker can capture sessions, alter what the user sees, or trigger actions that appear to come from the legitimate user.
Failure mechanism: The attacker leverages trusted content delivery or local execution to run code, read sensitive browser state, or abuse an authenticated session before server-side controls can detect the abuse.
Impact: Account takeover, token theft, data exfiltration, fraudulent actions, and downstream compromise of other systems that trust the stolen session or endpoint context can all follow.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1185 — Browser Session Hijacking | Client-side attacks commonly steal or abuse active browser sessions. |
| T1056.003 — Web Session Cookie | Client-side compromise often targets cookies and other web session material. | |
| Recommendation — Map browser-session abuse to T1185 and hunt for token theft and session replay. Monitor for cookie theft indicators and constrain session reuse after compromise. | ||
| NIST CSF 2.0 | PR.DS-10 — Cryptographic keys and related secrets are protected | Client-side attacks frequently expose secrets, tokens, and session material on endpoints. |
| PR.AA-05 — Authenticator management is maintained | Client-side compromise often abuses authenticators and session trust on the endpoint. | |
| Recommendation — Protect endpoint secrets and revoke exposed session material quickly. Enforce strong authenticator handling and reduce reliance on reusable browser state. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Client-side attacks exploit weak trust boundaries between browser content and local execution. |
| Recommendation — Isolate browser-facing execution paths and restrict trust across boundaries. | ||
Practitioner Guidance
What to watch for: Treat unexplained browser prompts, abnormal page behavior, suspicious extension activity, and unexpected session reuse as possible signs of client-side compromise. The main mistake is assuming that a successful login or trusted domain means the content being rendered is safe.
Practitioner takeaway: The control goal is not to make the browser “trusted”, it is to make trust narrow, revocable, and resilient to endpoint compromise.
Related resources from NHI Mgmt Group
- What is the difference between client-side attack surface monitoring and standard web application security testing?
- Why does client-side attack telemetry help security teams prioritize application defenses?
- What breaks when organisations keep using a compromised client-side library after the attack is discovered?
- How should security teams reduce client-side risk when AI-powered scripts and third-party tags are expanding the attack surface?
