Category: Threat Detection & Prevention

Strategies to Safeguard E-Commerce Payment Pages This Holiday Season

Posted on July 29, 2025 by - Data Governance & Privacy, Threat Detection & Prevention

As web applications grow more complex, client-side code has become a prime target for attackers. From third-party scripts to browser-based vulnerabilities, threats on the client-side are often overlooked until it’s too late.

In this article, we explore everything you need to know about client-side attacks and monitoring: what it is, why it matters, common attack types, and how to detect and mitigate them effectively.

What Are Client-Side Attacks?

Client-side refers to operations performed in the user’s web browser, rather than on the server hosting the website or application. In the context of web apps, client-side attacks typically target the JavaScript running in the browser, exploiting vulnerabilities to manipulate web pages, steal form data, hijack sessions, or inject malicious scripts, rather than compromising the user’s device directly.

What Are Some Examples of Client-Side Attacks?

Attackers use various methods to exploit the trusted relationship between users and the websites and apps they use. Some examples include:

  • Content Spoofing – Modifying content on a web page or app to trick users into thinking it is legitimate. 

  • Cross-Site Scripting (XSS) – Injecting malicious code into legitimate web pages viewed by users. The two most common ways in which this can happen are tricking a user into clicking a link containing malicious code, which then executes within the user’s web browser. Or embedding malicious code on a website where it is stored, for example, on message board posts, webmail, and web chat software.

  • Drive-By-Downloads – Users inadvertently download malicious code by simply visiting a compromised website; the user requires no action. 

  • Man-In-The-Browser (MitB) – Installing malicious code in the user’s browser which can intercept and manipulate data in real time as it is transmitted.

The above is not an exhaustive list of client-side attacks. Others involve hijacking, namely taking control of systems, software, or network communications, and are variously known as customer hijacking, session hijacking, formjacking, or clickjacking. Sometimes, client-side attacks are referred to by the more literal name of third-party browser script attacks.

What is the Relationship Between Client-Side Attacks and Digital Skimming?

Generally, attackers deploy a client-side attack to conduct digital skimming. Digital skimming attacks involve stealing sensitive data input by users into web forms. Frequently, this is payment data from online checkout pages, although it also includes personally identifiable information (PII) from other web forms.

Digital skimming is also known by various names, including e-skimming, data skimming, and formjacking. Then there are the more specific terms of JavaScript attacks or Magecart attacks, which hint at how digital skimmers exploit vulnerabilities in a website’s code or infrastructure to harvest data.

Why are Businesses Vulnerable to Client-Side Attacks?

If we were to summarize why businesses are vulnerable to client-side attacks in one word, it would be JavaScript. In the early years of the web, pages were built entirely in HTML. So, with each new click, a new page was loaded. And with every small change to a page, the entire page had to be refreshed. However, JavaScript and a group of interrelated web-programming technologies made it possible to send and receive data in the background, without having to reload the page. 

This move from static to dynamic web pages improved the ease of creating pages, the functionality, and the user experience. However, the comfort and elegance of using JavaScript are also the source of its weakness.

Around 99% of all websites now use JavaScript as their go-to client-side coding language. The use of third-party add-ons has also grown. As the name suggests, these add-ons are tools built by third-party developers to provide extra features to a web page, and can be seamlessly integrated.

Examples include AB testing, analytics, advertising, retargeting, and online payment. The business intelligence behind a website has now moved from web servers, owned and managed by companies, into the consumer web browser, powered by JavaScript, distributed APIs, and microservices.

As a result, any JavaScript running on a web page can access all data entered into form fields on that page. With no separation between different parts of the application, this increases the attack surface for possible breaches.

What are the Implications to Businesses of Client-Side Attacks?

It’s difficult to overstate the impact of client-side cyberattacks to a business’s brand, reputation and bottom line. It can include bankruptcy and business failure.

For example, DNA testing firm 23and Me filed for bankruptcy in March 2025, following a 2023 cyberattack that exposed the personal data of 7 million customers. The breach resulted in a $30 million settlement, staff layoffs, the resignation of the co-founder and the collapse of a company once valued at $6 billion.

New York University (NYU) suffered a data breach that exposed the personal information of more than 3 million applicants, including names, test scores, family backgrounds and financial aid details. A hacker then took control of the university’s official website in late March 2025 and modified content, purporting to show specific admissions data categorized by race. 

Cyberattacks hit UK supermarkets Marks & Spencer and The Co-op during March/April 2025. M&S customers were unable to use contactless payment in-store, shop online, which accounts for around £3.8 million in daily takings for M&S, or use click and collect services. The disruption and uncertainty wiped more than £600 million off the stock value in just over a week.

Meanwhile, the Co-op was forced to shut down part of its IT systems, including its stock management system, following a cyberattack. This led to empty shelves in some of its 2,000 stores. The group confirmed that hackers had also accessed customer data from its membership program, such as names and contact details.

What are the PCI DSS v4 Implications of Client-Side Attacks?

Given the ubiquity and innate security vulnerabilities of JavaScript, including on payment pages, the PCI Security Standards Council (PCI SSC) published an updated version of the PCI Data Security Standard (PCI DSS) in March 2022. Version 4 of the PCI DSS contains two new requirements to protect against and detect digital skimming attacks on payment pages. These requirements have been in effect since April 1, 2025.

  • Requirement 6.4.3 – the first new PCI requirement is designed to minimize the attack surface and manage all JavaScript present in the payment page. 

  • Requirement 11.6.1 – the second new PCI requirement aims to detect tampering or unauthorized changes to the payment page and generate an alert when changes are detected.

What is Client-Side Attack Surface Monitoring?

Client-side attack surface monitoring is a cybersecurity practice that focuses on continuously identifying, analyzing and mitigating potential entry points for attacks on the client-side of an application or website. 

It involves monitoring the behavior of applications and websites running on the user’s device, looking for suspicious activity and vulnerabilities that attackers could exploit.

As with most things in web application security, client-side security and cybersecurity in general, this involves a multi-layered approach. There are no silver bullets to detect, verify, monitor and block malicious code.

How do Businesses Protect Against Client-Side Attacks?

Given the dynamic nature of the web and JavaScript itself, businesses are advised to deploy a combination of the following to protect against client-side vulnerabilities.

  1. Real-Time Monitoring

One of the best ways to guarantee full visibility and control on the client-side is to implement real-time monitoring. Businesses must be able to detect unauthorized script activity on their websites at any time. That essentially means in real time. What’s more, businesses should receive alerts if their websites or applications are under attack. Plus, be able to act immediately and block or deactivate any malicious scripts.

In technical terms, this means analyzing the behavior of scripts to identify anomalies such as excessive network requests, unusual data manipulation or unexpected interactions with other elements on the website, which could indicate a malicious attack.

  1. Get Visibility Into Third-Party Scripts

It’s also recommended that businesses are fully aware of all the third-party scripts that are present on their website.

It’s helpful to maintain a dynamic inventory of all the scripts present on a website, including first-party and third-party code. It’s also one of the requirements mandated by PCI DSS v4, which mandates that e-commerce businesses maintain a full inventory of every script on their payment page.

In technical terms, verifying the integrity of JavaScript libraries means comparing JavaScript code with known and trusted scripts. This helps to determine whether a library or website domain has been tampered with or replaced by a malicious variant, and prevents the execution of compromised code.

  1. Other Client-Side Attack Prevention Strategies

There are a number of other strategies businesses can implement to prevent client-side attacks. These include but are not limited to:

  • Update and patch all software and apps associated with a website on a regular basis.

  • Use monitoring and inspection technology to alert in case of any unauthorized script activity. 

  • Split front-end applications into smaller components (e.g., facing, authentication and admin) to compartmentalize them and thereby reduce scope in the event of a breach.

  • Store sensitive website data in a dedicated meta field and keep API keys hidden from public view.

  • Use SSL certificates for all websites and ensure they are kept up to date.

  • Be cautious when selecting and implementing third and fourth-party scripts (those that a third-party supplier sources from elsewhere).

How Does Jscrambler Help Prevent Client-Side Attacks?

Jscrambler is the leader in client-side protection and compliance. We were the first to merge advanced polymorphic JavaScript obfuscation with fine-grained third-party tag protection in a unified client-side protection and compliance platform.


Our end-to-end solution does more than protect data — it empowers businesses. With Jscrambler, development teams are free to take full advantage of client-side JavaScript, safe in the knowledge that they have access to sweeping protection against current and emerging cyber threats, data leaks, misconfiguration, and IP theft. 

Trusted by big-name brands such as Air France-KLM, Netflix, NBCUniversal, Gap Inc. and Banco Santander, Jscrambler’s top client-side attack prevention features include:

  • Website Inventory – Real-time visibility of all scripts running on the website and how they access and transfer data. Provides an accurate picture of the overall exposure to third-party risk.

  • Form Fencing – The granularity of Jscrambler’s form-fencing feature allows the client to control which scripts can read and access form data, keeping malicious actors from siphoning sensitive information that users enter into forms.

  • Webpage Threat Mitigation – Powerful and granular rules engine that provides complete control of each script running on your website. Allows proactively or reactively blocking scripts that exhibit malicious behavior

  • Real-Time Alerts – Immediately flag high-risk behaviors and gain real-time reaction capabilities and notifications about external scripts.

  • Polymorphic Code Obfuscation – An extra layer of security and complexity to keep attackers out.

  • Code Locks – Prevent code from running outside set parameters for browser, date, or domain.

Ready to Prevent Web Client-Side Attacks?

Protect your business against client-side attacks, script injections, and unauthorized access to sensitive data by harmful third-party tags, pixels, and trackers with Jscrambler. Contact our experts today.

How to Strengthen E-commerce Security Against E-skimming Threats

Posted on May 13, 2025 by - Threat Detection & Prevention

E-commerce security: being an e-commerce merchant is not a point of difference in today’s digital world; it’s the default market entry point for businesses that recognize the modern consumers’ demand for convenience.

E-commerce sales- an estimated $4.9 trillion worldwide in 2021 – are projected to reach $8.1 trillion by 2026. Amid this exponential growth, an insidious threat lurks that underscores the importance of e-commerce security: e-skimming – a client-side attack targeting the prodigious amount of financial data inputted online.

Cybercriminals’ unwavering determination to exploit online trends to fraudulently harvest online payment data and personal information has prompted a surge in these nefarious attacks, which are also known as digital skimming, web skimming, data skimming, or Magecart attacks.

What is e-skimming? 


E-skimming attacks are client-side attacks that occur when cybercriminals inject malicious code onto an e-commerce website to compromise sensitive data – typically payment card data – inputted by users into checkout pages and other online forms.

These malicious actors often gain access to an e-commerce site by compromising assets originating from outside its security perimeter, including all client-side web assets—the files and resources that are downloaded and executed by a user’s web browser when they visit a website. 

During this process, cybercriminals typically target JavaScript, the fundamental programming language used client-side by over 98% of all websites to create interactive web pages.

JavaScript’s ubiquity – and its innate security vulnerabilities – make it a prime target for cybercriminals who attempt to weaponize it against organizations using this malicious skimming code. Once injected—either through a supply chain attack or a direct website hack — the code infiltrates the e-commerce website’s point of sale, allowing cybercriminals to intercept customer credit card details and personal data.

Crucially, these JavaScript skimming attacks occur outside the corporate network and, therefore, outside the parameters of traditional security controls, creating a blind spot for e-commerce businesses. 

The malicious code’s ability to hide in plain sight for weeks or even months means that once it’s infiltrated an online checkout or cart, customers will continue to submit their payment information, unaware that their data is being compromised. 

Once detected, the severe impact of these client-side attacks on businesses becomes apparent – from disruption to operations and the cost of technical remediation to reputational damage and regulatory penalties. For example, British Airways was issued a £183m GDPR fine – reduced to £20m – in 2020 after its website and mobile app were breached by an e-skimming attack. Hackers copied and modified JavaScript payment forms to redirect payment data to a server they controlled, resulting in the theft of sensitive information from 380,000 customers.

Digital supply chain: the risks  


The digital supply chain – an intricate web of interconnected technologies, data flows, and collaborations – is the fulcrum of modern digital business operations.
 

This virtual ecosystem of software, networks, vendors, partners, and data streams has the power to enhance efficiency; however, it also exposes e-commerce businesses to risks, such as third-party vulnerabilities and data breaches, that, if exploited, can disrupt operations, compromise data, and tarnish their reputation.

This threat is underscored by Gartner, which identified digital supply chain risk as one of its top seven security and risk management trends for 2022. Take JavaScript, for example. This programming language runs on all major browsers, making it one of the core technologies used to build web applications and websites. However, this pervasive use exposes e-commerce businesses and their users to an inherent security flaw: it allows cybercriminals to deliver malicious scripts to run on the front end of a system.

In e-skimming, this third-party code represents a chink in the digital supply chain’s armour that proponents of this fraudulent technique attempt to exploit. 

A typical e-commerce website’s client-side code mainly originates from outside the organization. These are the open-source script libraries and third-party add-ons that web developers leverage to build user-friendly functionalities like customer login pages and payment processing.

Despite saving time and resources, the opaque nature of this third-party code prevents e-commerce businesses from having complete visibility of the third-party scripts on their sites, leaving them blind to client-side supply chain attacks like e-skimming. 

Therefore, e-commerce merchants must balance leveraging this third-party code to stay relevant in a dynamic and expanding digital world with managing its inherent risks in the digital supply chain. To shield themselves from client-side supply chain attacks and demonstrate best practices, they must comply with the Payment Card Industry Data Security Standard (PCI DSS).

The PCI DSS’s fourth – and most recent – iteration aims to meet the evolving security needs of the payment industry, promote security as a continuous process, increase flexibility, and improve procedures for organizations to achieve their security goals.

Securing customer data entered into e-commerce payment forms 


Cybercriminals’ use of malicious code injections to skim payment data from input fields on existing web forms has amplified the need for e-commerce businesses to secure this collection of user interface components on a website.

On the one hand, the payment forms allow users to submit personal information to easily make a purchase within minutes; on the other, they create an additional attack vector for cybercriminals to exploit.  

Consequently, web form security – the set of tools and practices businesses use to protect web forms from e-skimming attacks – is a vital component of overall website security, and the benefits are compelling:

  • Trust Building: Trust is the cornerstone of customer relations in the e-commerce market. When customers provide their credit card information or other sensitive data, they expect it to be handled securely. By preventing breaches of this trust, e-commerce businesses will enhance their reputation in this uber-competitive market. 

  • Standards and regulatory compliance: Robust standards and regulations exist to reinforce web form security, such as GDPR and PCI DSS. This security standard ensures that businesses that accept, process, store, or transmit credit card information maintain a secure environment.

  • Revenue Protection: Well-designed web forms help e-commerce businesses convert website visitors into account holders, subscribers, or customers. By proactively securing customer data that’s entered into them, they can protect the revenue these forms facilitate. 

  • Third-party risk reduction: Web form security empowers e-commerce businesses that use a third-party service or plugin to create and manage web forms to assess their security and data handling practices – ensuring they follow best practices for data protection.


Client-side security best practices for secure forms


To securely collect data from users via web forms, they must be designed to incorporate a battery of proactive security measures, including: 

Data encryption

Data encryption protects information submitted by users both during transmission and when stored on the server. To maintain the confidentiality and integrity of user data, it harnesses robust encryption algorithms, public and private keys, and a trusted certificate infrastructure.

This is a fundamental aspect of web security and helps build trust with users by demonstrating a commitment to protecting their sensitive information.

Multi-factor authentication (MFA)/ Two-Factor Authentication (2FA)

MFA secures web forms by augmenting the traditional username and password authentication with the following verification factors:

  • Something you have: Users must provide something physical that only they possess, such as a smartphone, security token, or smart card. This second factor can be used to generate a one-time code or respond to a push notification.

  • Something you are: This refers to biometric data that is unique to the user, such as fingerprint, facial recognition, or iris scan.

Spam protection

Spam protection mechanisms—such as CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart)—enhance the security, reliability, and functionality of online forms by preventing unwanted or malicious submissions like automated bots, automated scripts, and spam submissions that overload the server. They also help ensure that the data collected is legitimate and trustworthy.


Secure communication protocols

Secure communication protocols like HTTPS and SSL/TLS encrypt web form data, ensuring its integrity, authenticating the server, and providing a trust framework through certificate authorities.

For example, encryption algorithms scramble the data transmitted between the user’s browser and the web server, making it extremely difficult for cybercriminals to intercept and decipher the transmitted data.

Client-side security

JavaScript security protects the web application from attack and ensures end users can safely engage with dynamic web pages accessed from their devices.

For example, client-side validation using JavaScript to check user inputs for correctness, such as email format, password strength, and required fields, helps improve user experience and prevents basic errors before data is submitted to the server.

Also, regarding the control of third-party scripts, not necessarily the content they put in forms, but who can access them?

Conclusion


According to Mastercard data, almost three-quarters of publicly disclosed breaches in 2022 involved this technique, with skimmers infecting 4,500 new sites—a 129% increase from 2021. This number rose by another 2,700 in 2023. Amid this widespread deployment of e-skimming scams, the FBI estimates that they now cost cardholders and banks over $1 billion every year.


This proliferation of web skimming or e-skimming attacks against e-commerce businesses is a symptom of the exponential growth of online retail sales and cybercriminals’ determination to exploit this online activity. 

This new reality has brought the need to strengthen e-commerce security against these client-side attacks into sharp focus for these online entrepreneurs, from implementing proactive security measures that secure web forms and reinforce third-party code to complying with PCI DSS v4.

By understanding the new PCI DSS v4 requirements and leveraging advanced solutions like Jscrambler, businesses can protect online transactions, ensure compliance, and maintain consumer trust.

How to Stop Data Breaches in Your Business: A Strategic Overview

Posted on March 18, 2025 by - Data Governance & Privacy, Threat Detection & Prevention

Whether your business is large or small, whether you trade in physical places, on the Internet, over the telephone, or via mail order, and whether you accept hundreds or hundreds of thousands of card payments monthly—can your business afford to be hacked?

Customers will not thank your business or continue to reward it with loyalty if you lose their data or handle it in a way that someone else can steal and misuse it. That’s the bottom line.

So, it stands to reason that all businesses must improve their data breach prevention, proactively defend themselves, and safeguard their ability to trade and continue trading online. That can be primarily achieved by protecting customer data, especially payment data, but also by protecting their own intellectual property (IP) and enforcing software licensing.

How to Stop Data Breaches: What Is The Strongest Way To Protect Sensitive Customer Data?

When it comes to protecting sensitive customer data online, prevention is better, cheaper, and less painful than the cure.

Businesses want to choose a platform that protects them against client-side attacks, script injections, and unauthorized access to sensitive data by potentially dangerous third-party tags, pixels, and trackers. Plus, one that helps them:

  • EnableIn-Depth Defense 

Keep your business secure and compliant by layering your levels of protection with code obfuscation and maximum visibility over third-party scripts.

  • Navigate Changing Regulations

Stay ahead of the ever-changing regulatory landscape with a platform that helps your business comply with new requirements, like PCI DSS v4, before they become effective.

  • Deliver Short-Term ROI

Consider a platform that’s managed offsite and needs minimal maintenance once in place to demonstrate short-term ROI.

  • Manage Risk Effectively

Benefit from continuous, real-time monitoring of first- and third-party scripts on payment pages and forms and get instant alerts of anomalies and suspicious behavior.

  • Move Faster, Be Bolder

Become a fearless digital innovator, knowing that your IP and sensitive data are secure and your user experience is unaffected by page performance.

  • Strike The Right Balance 

Seamlessly integrate compliance into business processes without trade-offs between security, compliance, and business goals.

  • Partner With A Client-Side Protection Leader

Choose a best-in-class client-side protection platform trusted by big-name brands.

Reverse engineering, zero-day exploits, code modification, and more. The hacker threat is real. Safeguard your customer data, intellectual property, and digital assets, as well as your revenue and competitive advantage.

Is Client-Side Validation Sufficient For Security?

Client-side validation is important in improving user experience by catching errors early. For example, it provides an immediate prompt when a user enters an invalid e-mail address. However, relying on client-side validation exclusively is risky for several reasons.

Client-side validation is executed in the user’s browser, which means it can be easily bypassed or manipulated by an attacker. The validation logic is part of the client-side code and is visible to anyone. Such transparency makes it easier for attackers to understand how to circumvent checks.

Different browsers or user settings may affect client-side code, potentially leading to inconsistent validation results. What’s more, security measures should always be implemented in layers. A successful security strategy should be less of a single line of defense and more of an in-depth defense.

For example, Jscrambler’s comprehensive JavaScript monitoring and protection solution ensures your web apps are protected from client-side threats without damaging user experience and simplifying data privacy and compliance.

  • Application Shielding

With polymorphic obfuscation, code locks, and runtime protection, attackers can’t reverse engineer, debug, or tamper with your web/mobile app code.

  • Webpage Threat Mitigation

Powerful and granular rules engine to control each script running on your website. Allows proactive or reactive blocking of scripts exhibiting malicious behavior.

  • Real-Time Threat Notifications

Get instant alerts and benefit from real-time self-defense against tampering, debugging, or poisoning attempts.

  • Compliance with Regulations

Manage data access and transfer on the client side to better comply with regulations, such as PSD2, PCI DSS, GDPR, and CCPA.

  • Third-Party Risk Management

To secure your supply chain, the Jscrambler engine scrutinizes every user session in real time, regardless of the user’s device or browser.

Jscrambler enables online businesses to prevent consumer data leakage with client-side protection and compliance solutions.

What Are The Repercussions Of Data Security Breaches?

The fully loaded costs of a data breach are far bigger than just the cost of regulatory fines, although these can be significant. For example, non-compliance with GDPR can be up to 4% of annual global turnover or €20 million. The business repercussions could be extensive. They include operational disruption, lost productivity, staff downtime, increased insurance premiums, the cost of recovering lost information, equipment, or data, and the lost revenue of being unable to trade. 

Then there are the direct costs: incident response costs, technical and forensic support costs, breach notification costs, compliance and regulatory fines, and the indirect costs of loss of brand value, reputation, and trust. 

How Do Security Breaches Impact Compliance?

Non-compliance with data security breaches can result in fines, enforcement notices, regulatory investigations, and significant costs (direct, indirect, and opportunity costs). 

How To Handle Website Security And Data Protection

Digital skimming, sometimes also known as e-skimming, web skimming, data skimming, or formjacking, involves stealing sensitive data inputted by users into web forms. 

Skimming is becoming more sophisticated and prevalent. In the first two months of 2025 alone, there have been several high-profile skimming attacks. 

US food delivery platform Grubhub confirmed in February 2025 that hackers breached its internal systems to access the personal details of customers and drivers. More than 375,000 merchants and 200,000 delivery providers in over 4,000 US cities use the Grubhub platform. 

UK telecommunications company Talk Talk initiated an investigation in January 2025 after a hacker claimed to sell information from current and former customers online.

Our own research revealed that the casio.co.uk web skimmer had compromised a growing number of websites and stolen sensitive payment card data.

Given JavaScript’s ubiquity and innate security vulnerabilities on payment pages, the PCI Security Standard Council (PCI SSC) published an updated version of the PCI Data Security Standard (PCI DSS) in March 2022. 

Version 4 of the PCI DSS contains two new requirements to protect against and detect digital skimming attacks on payment pages, effective from April 1, 2025.

  • Requirement 6.4.3—The first  PCI requirement is designed to minimize the attack surface and manage all JavaScript present on the payment page. 

  • Requirement 11.6.1 – The second  PCI requirement aims to detect tampering or unauthorized changes to the payment page and generate an alert when changes are detected.

Jscrambler helps businesses that accept card payments achieve frictionless compliance with requirements 6.4.3 and 11.6.1 of PCD DSS v4. Fast-track your compliance by protecting your web pages within 24 hours of deployment. Our agentless monitoring solution flags potential follow-ups as they occur. 

Don’t just take our word for it. Request a free, no-obligation demo today to see these features in action.