Formjacking

Expanded Definition

Formjacking is a web skimming technique in which malicious code is injected into a website to intercept data typed into online forms before it reaches the intended service. It is commonly associated with payment checkout pages, account sign-in forms, and any workflow that collects secrets, credentials, or personal data.

In NHI and application security terms, formjacking is less about stealing a server-side database and more about abusing the client-side trust boundary. The attacker relies on the fact that the browser executes page scripts with access to form fields, meaning a compromise in third-party JavaScript, a vulnerable content management system, or an exposed deployment pipeline can turn ordinary form submission into data exfiltration. Guidance varies across vendors on whether to classify it as malware, web skimming, or client-side supply chain compromise, but the operational risk is the same: data is captured at the point of entry. See also NIST SP 800-53 Rev 5 Security and Privacy Controls for control expectations around system integrity and monitoring.

The most common misapplication is treating formjacking as a backend breach, which occurs when teams investigate only databases and ignore the client-side scripts that captured the data.

Examples and Use Cases

Implementing defenses against formjacking rigorously often introduces extra review, monitoring, and release friction, requiring organisations to weigh fast front-end changes against tighter control over what executes in the browser.

• A checkout page loads a compromised third-party payment widget that quietly copies cardholder data and sends it to an attacker-controlled endpoint.
• A login form is altered through a compromised content delivery path, allowing credentials to be collected before the browser posts them to the authentication service.
• A site using a vulnerable tag manager or script bundle inherits malicious code from a poisoned dependency, creating a hidden skimming path across multiple pages.
• An organisation discovers that a development change introduced an unsanctioned script that runs on all customer forms, exposing data until the deployment is rolled back.

For broader identity and secret exposure patterns, the Ultimate Guide to NHIs is useful because formjacking often succeeds when secrets, tokens, or credentials are collected in high-value web workflows. Where the web page itself is part of the trust chain, NIST SP 800-53 Rev 5 Security and Privacy Controls helps anchor expectations for integrity monitoring and change control.

Why It Matters in NHI Security

Formjacking matters because NHI security is often undermined at the moment a human or machine enters a secret into a browser. A stolen password, API key, or one-time credential can become an NHI foothold, especially when the captured value is later reused in automation, service account workflows, or administrative portals. NHI Mgmt Group notes that Ultimate Guide to NHIs reports that 79% of organisations have experienced secrets leaks, and 77% of those incidents resulted in tangible damage, which shows how quickly a browser-side compromise becomes an enterprise incident.

Practical governance should therefore include script allowlisting, dependency review, runtime integrity monitoring, and rapid revocation paths for any credential that may have been exposed through a form. Defences only work when the organisation assumes the page itself can be hostile, not just the backend. Organisations typically encounter session hijacking, payment fraud, or account takeover only after abnormal transactions or login anomalies appear, at which point formjacking becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• How should security teams prevent formjacking on websites with third-party scripts and forms?
• Why does formjacking remain effective when websites look secure to users?