Formjacking

What formjacking is and how it works

Formjacking is a client-side attack that compromises the page a user trusts, not the payment processor or login service behind it. The attacker inserts script into the page or its supply chain, then waits for visitors to type data into a live form. Because the malicious logic runs in the browser, the page may still appear to function normally while the data is quietly copied elsewhere.

This makes formjacking especially dangerous in checkout flows, sign-in pages and other high-value forms. The compromise is often short on visible signs and long on business impact, because the user believes they are interacting with a legitimate site while the page is actively leaking submitted information.

Why formjacking is effective against trusted web pages

Formjacking succeeds because modern sites rely on many moving parts, including third-party scripts, tag managers, analytics tools and frontend libraries. If an attacker compromises one of those paths, they can alter the page before the browser renders it. In practice, that means the attack can target a specific form field, a specific page type, or a specific visitor flow without breaking the rest of the site.

The technique is effective even when the core application and backend remain intact. The attacker only needs a brief opportunity to run code in the browser at the point where the user enters sensitive information. That browser-level position is what makes the attack attractive for stealing card data, credentials and other high-value input.

NHIMG’s Client-Side Security Guide covers the browser-side controls that matter most here, including script integrity, trusted script handling and monitoring for third-party abuse.

What organisations should examine when checking exposure

Exposure is usually found by reviewing where the site accepts sensitive form input and which scripts execute on those pages. Asset inventory matters, but so does page-level mapping: checkout pages, account recovery flows, embedded widgets and tag-managed pages are common targets. Teams should also compare what is actually delivered in production against what was approved, because formjacking often appears through unexpected script changes rather than obvious application defects.

Internet exposure matters as well. Publicly reachable forms with payment or authentication data are the highest-value candidates, especially when the site loads many third-party dependencies. Vendor advisories and security notices from script providers, payment plugins and frontend tooling can be the earliest clue that a page is at risk or already altered.

Cross-checking page behaviour against expected script inventory is often more useful than a one-time review, because the malicious code can be introduced, swapped, or reinserted after an initial cleanup.

Remediation and detection after suspected compromise

When formjacking is suspected, the immediate priority is to remove the injected code, restore trusted assets and narrow the exposure window. Teams should preserve evidence from the served page, browser-side script loads and relevant logs before making further changes, because the compromise path and the affected window are often central to both incident response and downstream notification decisions.

Detection is usually strongest when organisations compare known-good script baselines with what users actually received, then look for unusual outbound destinations, modified inline handlers or unexpected changes to page resources. After cleanup, the review should extend to any data that may have been captured while the skimmer was active, including card details, usernames, passwords and session-related material that could enable follow-on misuse.

NHIMG’s Web Skimming Incident Playbook is the most direct operational companion for confirming the exposure window, removing injected scripts and handling the response path.

Risk and Threat Considerations

Formjacking creates a high-trust interception point at the exact moment a user submits sensitive data. The main danger is that the site can appear healthy while the attacker is quietly exfiltrating form contents from the browser, which makes the compromise both operationally disruptive and hard to spot.

Failure mechanism: An attacker compromises client-side code or a dependent script source, then copies selected form fields before the data reaches the legitimate backend. Because the page still loads and submits normally, the malicious logic can persist until the altered script is removed or overwritten.

Impact: Stolen payment data, credentials and other entered secrets can drive fraud, account takeover and notification obligations, and a single compromised page can expose many users before the issue is detected.

Practitioner Guidance

What to watch for: Treat formjacking as a page-integrity problem, not only a server-side incident. The most useful operational question is whether the site can prove that the browser received the intended code path for its most sensitive forms, every time they load.

Governance implication: Ownership should include the frontend, the script supply chain and the incident response path for compromised pages. Teams that control only the backend often miss the place where the theft actually occurs.

Practitioner takeaway: If a page collects sensitive data, you need controls that verify what the browser executes, not just what the application was supposed to serve.

Related resources from NHI Mgmt Group

• How should security teams prevent formjacking on websites with third-party scripts and forms?
• Why does formjacking remain effective when websites look secure to users?
• What is the difference between formjacking and ordinary website malware infection?
• Why does formjacking create so much risk for online payments and checkout forms?