A technique where malicious code hooks normal application functions to observe or duplicate data as it moves through the user device. In mobile apps, it can capture inputs, responses, and tokens without breaking the app’s visible behaviour, making backend monitoring insufficient on its own.
Expanded Definition
Client-side shimming is a form of runtime interception in which hostile code inserts itself between an application and the device-level functions it relies on, then copies or alters data as it passes through. In mobile and browser-based environments, that can include keystrokes, form submissions, session tokens, API responses, or cryptographic material before the application has a chance to protect it. The application may continue to behave normally, which is why this technique is often missed by server logs and traditional backend monitoring.
Definitions vary across vendors when the term is used alongside web injection, instrumentation abuse, or app tampering, but the security meaning is consistent: the attacker is not merely stealing data at rest or in transit, they are capturing it inside the trusted client execution path. That makes this concept especially relevant to NHI workflows where tokens and app-to-app credentials live briefly on endpoint devices. NIST’s NIST SP 800-53 Rev 5 Security and Privacy Controls provides the control language organisations use to reduce exposure through stronger access, monitoring, and device protection.
The most common misapplication is treating client-side shimming as if it were only server-side credential theft, which occurs when teams overlook data exposure at the point where the user device executes the app.
Examples and Use Cases
Implementing detection and prevention rigorously often introduces device-level visibility demands, requiring organisations to balance user experience and platform compatibility against stronger assurance over what the client is actually doing. Guidance in browser and mobile security is still evolving, so teams should anchor decisions in authoritative controls such as NIST guidance and application hardening practices rather than assuming backend telemetry is enough. For broader context on application-layer threats, the OWASP guidance in the OWASP Top Ten is a useful companion reference.
- A malicious accessibility service on Android reads one-time passcodes and session tokens as the user enters them into a banking app.
- A browser extension hooks form submission functions to duplicate payment details before the page sends them to the merchant backend.
- A compromised enterprise device injects JavaScript into a web app and captures API responses containing personal data or entitlement claims.
- A fake mobile SDK performs runtime shimming to exfiltrate OAuth tokens while leaving login and transaction screens visually intact.
- An attacker uses instrumentation tools to observe calls to local security libraries and weaken protections around secrets in memory.
Why It Matters for Security Teams
Client-side shimming matters because it breaks the assumption that application integrity can be judged from server-side logs alone. Security teams may have strong controls around authentication, API gateways, and session management, yet still lose sensitive data when hostile code operates on the endpoint before those controls are reached. That is particularly important for IAM and NHI programs, where short-lived tokens, delegated access, and embedded secrets can be harvested from the user device and reused elsewhere.
It also changes incident response priorities. When shimming is present, the core question is not just whether credentials were stolen, but whether the device, browser, or mobile runtime can still be trusted. The combination of application monitoring, endpoint detection, and access governance becomes necessary, and the security conversation shifts from single-event compromise to endpoint compromise with downstream identity abuse. Organisations typically encounter session replay, unauthorised API use, or fraud only after anomalous transactions appear, at which point client-side shimming becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 | Client-side shimming exploits weak access and session protections at the endpoint. |
| NIST SP 800-53 Rev 5 | SI-4 | Monitoring controls support detection of suspicious client runtime manipulation. |
| OWASP Non-Human Identity Top 10 | NHI guidance addresses secret exposure and runtime abuse in client-dependent identity flows. |
Instrument endpoints and apps to detect tampering, injection, and abnormal process behavior.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
