The Biggest Client-Side Attacks, and What They Share
Five client-side attacks on one timeline: Ticketmaster (2018, a third-party chat supplier's script altered on the payment page), British Airways (2018, a library the booking pages already loaded was changed; about two weeks; £20 million ICO fine), Polyfill (2024, a service used by more than 100,000 sites changed hands and served altered code from the same address), CosmicSting (2024, an unpatched Adobe Commerce and Magento flaw) and DebugBear / Polymarket (2026, a performance monitoring script served a wallet drainer). Four came through a source the site already trusted; all ran in the visitor's browser, so the pages kept working and nothing on the server looked unusual. The video ends with the signal that would have caught each: an approved script whose payload changed, a script not in your inventory, a script reading payment fields, and a new outbound destination.
Full answer: What Is Magecart? Groups, Methods and Real Incidents
Transcript
The best-known client-side attacks, British Airways, Ticketmaster, Polyfill and DebugBear, share one pattern. The code arrived through a source the site already trusted, and it ran in the visitor's browser, so the pages kept working and nothing on the server looked unusual. Here are five on one timeline. Four came through a trusted source. One came a different way. In 2018, a customised JavaScript file from Inbenta, Ticketmaster's chat supplier, was altered and served on its payment pages, capturing card data. Ticketmaster didn't write that code, and it wasn't on its servers. The same year, attackers changed a library British Airways' booking pages already loaded. It ran for about two weeks, and the ICO later fined the airline £20 million. In 2024, a free polyfill service used by more than 100,000 sites changed hands. The new owner served altered code from the same address. It fired for some mobile visitors, at some times, and stayed quiet for site administrators. CosmicSting, also 2024, is the exception. Adobe patched a flaw in Adobe Commerce and Magento, many stores didn't apply the fix in time, and attackers used it to plant skimmers on checkout. Within a few months, about 5% of those stores were hacked. And in 2026, DebugBear's performance monitoring script served a wallet drainer to Polymarket users. Published estimates trace about $2.5 million to the attacker's wallet. So here's the pattern. The code came through a source the site already trusted. It ran in the visitor's browser. So the pages kept working, looked normal to the people running them, and nothing on the server looked unusual. What would have caught each? For Ticketmaster, British Airways, Polyfill and DebugBear, an approved script whose code changed. For CosmicSting, a script that isn't in your inventory. And in every case, a script doing something new, like reading payment fields or sending data somewhere new. Script Monitoring watches every script in every real session, from one tag, and puts what needs you today on one screen. It's free for 1,000 page views a month, and Pro starts at $99 a month, with a 14-day trial. Start for free at scriptmonitoring.com.