Injected scripts can silently intercept data as users type it into forms, then exfiltrate credentials or payment details before the application notices. In e skimming and formjacking scenarios, the attack often persists because the compromised code still looks legitimate to users and operators. That is why teams need web page monitoring, secure transport, and strong script control.
How injected JavaScript turns a form into a live data tap
When malicious code lands in a checkout or login page, the page itself becomes the collection point. The script can hook keystrokes, read form fields before submission, and capture data at the moment the user believes it is private. Because the interaction still happens in the legitimate browser session, the attack blends into normal page behaviour and is hard to spot from server-side logs alone.
The key security issue is not just theft, but timing and trust. Card data, passwords, one-time codes, session tokens, and address details can all be observed in the browser before any downstream control sees them. That makes injected JavaScript especially effective in environments where a page renders sensitive fields and users trust the visible domain.
Why checkout and login forms are such high-value targets
Checkout pages are attractive because they concentrate payment details and often run across many transactions, while login pages are attractive because they expose credentials and sometimes MFA-related data. A successful injection can capture multiple classes of secrets in one place, then reuse or sell them for account takeover, fraud, or further access. In practice, the harm is often broader than a single stolen field.
These attacks commonly arrive through the Shai Hulud npm malware campaign or other supply-chain paths that place malicious code inside otherwise trusted front-end assets. A useful practitioner benchmark is that NHI Mgmt Group’s Ultimate Guide to Non-Human Identities reports that 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage, which is a reminder that exposed browser-side material often has real downstream impact.
Controls that matter most when the page itself may be hostile
Defence has to assume the browser may see more than the server intends. Strong script control, content security policies, integrity checks for third-party assets, and continuous page monitoring help detect unauthorised changes before they stay live long enough to matter. Secure transport protects data in transit, but it does not stop a script that is already executing in the user’s session from reading the input first.
For payment contexts, PCI DSS v4.0 remains a relevant control reference because it pushes least-privilege access and tighter handling of system and application accounts in payment environments. For broader software delivery discipline, OWASP SAMM supports building secure coding and release practices into the development lifecycle, which is where script injection risk is most economically reduced.
Risk and Threat Considerations
Injected form skimmers are dangerous because they abuse the trust boundary between the user and the page, not just between the browser and the server. The attacker’s objective is usually silent collection and persistence, so the compromise can continue until the page asset is replaced, not until the server is fully breached.
Failure mechanism: A malicious script is delivered through compromised page assets, third-party libraries, tag managers, or another front-end path, then reads form values before submission and exfiltrates them out of band.
Impact: The organisation can lose credentials, payment data, and session material at scale, then face account takeover, fraud, chargebacks, incident response cost, and loss of customer trust.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS Control 6 — Access Control Management | Restricts script and admin access paths that can alter sensitive web pages. |
| CIS Control 8 — Audit Log Management | Supports detection of unexpected page or asset changes tied to formjacking. | |
| CIS Control 16 — Application Software Security | Directly addresses insecure scripts, third-party code, and injection into web apps. | |
| Recommendation — Apply least-privilege access to web delivery and release systems. Centralise and review logs for front-end asset changes and suspicious delivery activity. Build code review, testing, and integrity checks into the release pipeline. | ||
| NIST CSF 2.0 | PR.DS — Data Security | Protects sensitive form data from disclosure while in use and in transit. |
| DE.CM — Continuous Monitoring | Supports detection of unauthorized changes to live pages and scripts. | |
| Recommendation — Protect sensitive checkout and login data with layered data-security controls. Monitor production pages and script inventory for unexpected changes. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Secrets Exposure and Leakage | Injected scripts often steal credentials, tokens, and payment-related secrets. |
| NHI-07 — Visibility and Detection | Page monitoring and asset visibility are central to spotting malicious script insertion. | |
| NHI-10 — Supply Chain and Third-Party Risk | Malicious JavaScript frequently arrives through trusted libraries, tags, or build dependencies. | |
| Recommendation — Prevent browser-side exposure of credentials, tokens, and other secrets. Instrument visibility so unexpected script changes are detected quickly. Verify third-party script provenance and integrity before deployment. | ||
Practitioner Guidance
What to verify: Treat any change to checkout or login JavaScript as security-relevant. Verify source provenance, asset integrity, and whether the page can still function if a third-party script is removed or delayed.
What to prioritise: Focus first on the scripts that execute on the most sensitive pages, especially those that can read input fields, modify DOM behaviour, or load other remote code at runtime.
Practitioner takeaway: The safest assumption is that whatever runs in the page can see the data in the page, so control the script supply chain as tightly as you control the back end.
Related resources from NHI Mgmt Group
- What happens when malicious code is injected into CloudFormation templates during a CDK deployment
- What happens when security teams treat every anonymized login as malicious?
- What happens when malicious extensions or injected scripts are allowed inside headless browser workflows?
- What happens when users enter a malicious device code on a trusted login page?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
