Formjacking is an attack in which criminals inject malicious JavaScript into a website’s checkout or login forms to steal payment card details and other data as users type them.
How formjacking works
Attackers first get their code onto the target page, either by hacking the site itself – often a vulnerable e-commerce platform such as Magento – or by compromising a third-party script the site loads, such as analytics, a chat widget or a payment plugin. The injected JavaScript listens to form fields or the submit button, copies card numbers, expiry dates, CVV codes and addresses, and sends them to an attacker-controlled server, often on a domain made to look like a legitimate analytics service. The purchase still completes normally, so neither the customer nor the shop notices. The stolen data is sold on carding markets.
Groups conducting these attacks are collectively known as Magecart, after their early focus on Magento shops.
Why formjacking matters
- British Airways (2018) – a modified script on the website and app captured payment data of hundreds of thousands of customers; the UK regulator later fined the airline £20 million.
- Ticketmaster (2018) – data was stolen through a compromised customer support chatbot supplied by a third party, a typical supply chain attack.
- Newegg (2018) – card data was skimmed from its checkout page for about a month.
How to protect against formjacking
- Use a strict Content Security Policy that limits where scripts can load from and send data to.
- Apply Subresource Integrity (SRI) hashes to third-party scripts and minimise their number on payment pages.
- Monitor checkout pages for script changes; PCI DSS 4.0 requires an inventory and integrity checks for payment page scripts.
- Patch e-commerce platforms and plugins and protect admin accounts with MFA.
