As web applications grow more complex, attackers increasingly target client-side code. From third-party scripts to browser-based vulnerabilities, client-side threats are often overlooked until it’s too late.
In this article, we explore everything you need to know about client-side attacks and monitoring: what they are, why they matter, common attack types, and how to detect and mitigate them effectively.
What is Client-Side Attack Surface?
Client-side refers to operations performed in the user’s web browser, rather than on the server hosting the website or application. In web apps, client-side attacks typically target JavaScript running in the browser, exploiting vulnerabilities to manipulate web pages, steal form data, hijack sessions, or inject malicious scripts, rather than directly compromising the user’s device.
What Are Some Examples of Client-Side Attacks?
Attackers use various methods to exploit the trusted relationship between users and the websites and apps they use. Some examples include:
- Content Spoofing – Modifying content on a web page or app to trick users into thinking it is legitimate.
- Cross-Site Scripting (XSS) – Injecting malicious code into legitimate web pages viewed by users. The two most common ways this happens are tricking a user into clicking a link containing malicious code, which then executes in the user’s web browser. Or embedding malicious code on a website where it is stored, for example, on message board posts, webmail, and web chat software.
- Drive-by downloads – Users inadvertently download malicious code simply by visiting a compromised website; the user takes no action.
- Man-In-The-Browser (MitB) – Installing malicious code in the user’s browser which can intercept and manipulate data in real time as it is transmitted.
The above is not an exhaustive list of client-side attacks. Others involve hijacking, namely taking control of systems, software, or network communications, and are variously known as customer hijacking, session hijacking, formjacking, or clickjacking. Sometimes, client-side attacks are referred to by the more literal name of third-party browser script attacks.
What is the Relationship Between Client-Side Attacks and Digital Skimming?
Generally, attackers use client-side attacks to conduct digital skimming. Digital skimming attacks steal sensitive data users enter into web forms. Often, this includes payment data from online checkout pages, but it can also involve personally identifiable information (PII) from other web forms.
Digital skimming is also known as e-skimming, data skimming, and formjacking. More specific terms include JavaScript attacks or Magecart attacks, which hint at how digital skimmers exploit vulnerabilities in a website’s code or infrastructure to harvest data.
Why are Businesses Vulnerable to Client-Side Attacks?
If we were to summarize why businesses are vulnerable to client-side attacks in one word, it would be JavaScript. In the early years of the web, pages were built entirely in HTML. So, with each new click, a new page was loaded. With every small change to a page, the entire page had to refresh. However, JavaScript and a group of interrelated web-programming technologies made it possible to send and receive data in the background without reloading the page.
This shift from static to dynamic web pages improved ease of creation, functionality, and user experience. However, the comfort and elegance of using JavaScript are also the source of its weakness.
Around 99% of all websites now use JavaScript as their go-to client-side coding language. Third-party add-ons have also grown. As the name suggests, these add-ons are tools built by third-party developers to provide extra features to a web page, and can be seamlessly integrated.
Examples include AB testing, analytics, advertising, retargeting, and online payment. The business intelligence behind a website has moved from web servers owned and managed by companies into the consumer web browser, powered by JavaScript, distributed APIs, and microservices.
As a result, any JavaScript running on a web page can access all data entered into form fields on that page. With no separation between different parts of the application, this increases the attack surface for possible breaches.
What are the Implications to Businesses of Client-Side Attacks?
It’s difficult to overstate the impact of client-side cyberattacks on a business’s brand, reputation, and bottom line. They can even lead to bankruptcy and business failure.
For example, DNA testing firm 23andMe filed for bankruptcy in March 2025 after a 2023 cyberattack exposed the personal data of 7 million customers. The breach resulted in a $30 million settlement, staff layoffs, the resignation of the co-founder, and the collapse of a company once valued at $6 billion.
New York University (NYU) suffered a data breach that exposed the personal information of more than 3 million applicants, including names, test scores, family backgrounds and financial aid details. A hacker then took control of the university’s official website in late March 2025 and modified content, purporting to show specific admissions data categorized by race.
Cyberattacks hit UK supermarkets Marks & Spencer and The Co-op during March/April 2025. M&S customers were unable to use contactless payment in-store, shop online, which accounts for around £3.8 million in daily takings for M&S, or use click and collect services. The disruption and uncertainty wiped more than £600 million off the stock value in just over a week.
Meanwhile, the Co-op was forced to shut down part of its IT systems, including its stock management system, following a cyberattack. This left shelves empty in some of its 2,000 stores. The group confirmed that hackers also accessed customer data from its membership program, including names and contact details.
What are the PCI DSS v4 Implications of Client-Side Attacks?
Given the ubiquity and innate security vulnerabilities of JavaScript, including on payment pages, the PCI Security Standards Council (PCI SSC) published an updated version of the PCI Data Security Standard (PCI DSS) in March 2022. Version 4 of the PCI DSS contains two new requirements to protect against and detect digital skimming attacks on payment pages. These requirements have been in effect since April 1, 2025.
- Requirement 6.4.3 – the first new PCI requirement is designed to minimize the attack surface and manage all JavaScript present on the payment page.
- Requirement 11.6.1 – the second new PCI requirement aims to detect tampering or unauthorized changes to the payment page and generate an alert when changes are detected.
What is Client-Side Attack Surface Monitoring?
Client-side attack surface monitoring is a cybersecurity practice that focuses on continuously identifying, analyzing, and mitigating potential entry points for attacks on the client-side of an application or website.
It involves monitoring the behavior of applications and websites running on the user’s device, looking for suspicious activity and vulnerabilities that attackers could exploit.
As with most things in web application security, client-side security and cybersecurity in general, this involves a multi-layered approach. No silver bullet can detect, verify, monitor, and block malicious code.
How do Businesses Protect Against Client-Side Attacks?
Given the dynamic nature of the web and JavaScript, businesses are advised to deploy a combination of the following measures to protect against client-side vulnerabilities.
- Real-Time Monitoring
One of the best ways to ensure full visibility and control on the client side is to implement real-time monitoring. Businesses must be able to detect unauthorized script activity on their websites at any time. That essentially means in real time. What’s more, businesses should receive alerts if their websites or applications are under attack. Plus, they should be able to act immediately and block or deactivate any malicious scripts.
In technical terms, this means analyzing the behavior of scripts to identify anomalies such as excessive network requests, unusual data manipulation, or unexpected interactions with other elements on the website, which could indicate a malicious attack.
- Get Visibility Into Third-Party Scripts
Businesses should also be fully aware of all third-party scripts present on their website.
It’s helpful to maintain a dynamic inventory of all the scripts present on a website, including first-party and third-party code. PCI DSS v4 also requires e-commerce businesses to maintain a full inventory of every script on their payment page.
In technical terms, verifying the integrity of JavaScript libraries means comparing JavaScript code with known, trusted versions. This helps determine whether a library or website domain has been tampered with or replaced with a malicious variant and prevents the execution of compromised code.
- Other Client-Side Attack Prevention Strategies
Businesses can implement several other strategies to prevent client-side attacks. These include but are not limited to:
- Update and patch all software and apps associated with a website on a regular basis.
- Use monitoring and inspection technology to alert in case of any unauthorized script activity.
- Split front-end applications into smaller components (e.g., facing, authentication and admin) to compartmentalize them and thereby reduce scope in the event of a breach.
- Store sensitive website data in a dedicated meta field and keep API keys hidden from public view.
- Use SSL certificates for all websites and keep them up to date.
- Be cautious when selecting and implementing third- and fourth-party scripts (those that a third-party supplier sources from elsewhere).
How Does Jscrambler Help Prevent Client-Side Attacks?
Jscrambler is the leader in client-side protection and compliance. We were the first to merge advanced polymorphic JavaScript obfuscation with fine-grained third-party tag protection in a unified client-side protection and compliance platform.
Our end-to-end solution does more than protect data — it empowers businesses. With Jscrambler, development teams are free to take full advantage of client-side JavaScript, safe in the knowledge that they have access to sweeping protection against current and emerging cyber threats, data leaks, misconfiguration, and IP theft.
Trusted by big-name brands such as Air France-KLM, Netflix, NBCUniversal, Gap Inc. and Banco Santander, Jscrambler’s top client-side attack prevention features include:
- Website Inventory – Real-time visibility of all scripts running on the website and how they access and transfer data. Provides an accurate picture of the overall exposure to third-party risk.
- Form Fencing – Jscrambler’s form-fencing feature lets the client control which scripts can read and access form data, preventing malicious actors from siphoning sensitive information users enter into forms.
- Webpage Threat Mitigation – Powerful and granular rules engine that provides complete control of each script running on your website. Allows proactively or reactively blocking scripts that exhibit malicious behavior
- Real-Time Alerts – Immediately flag high-risk behavior and enable real-time reactions and notifications about external scripts.
- Polymorphic Code Obfuscation – An extra layer of security and complexity to keep attackers out.
- Code Locks – Prevent code from running outside set parameters for browser, date, or domain.
Ready to Prevent Web Client-Side Attacks?
Protect your business against client-side attacks, script injections, and unauthorized access to sensitive data by harmful third-party tags, pixels, and trackers with Jscrambler. Contact our experts today.
