What Is Formjacking? How Checkout Forms Get Hijacked
Formjacking can hit any form worth stealing from, but it is most associated with card numbers at checkout. This video explains the two implementations (listening to your real form, or replacing it with an identical one that passes the data on), why the browser lets any script read any input, why your servers and logs never see it, and the five signals that catch each variant. It also covers where a Content Security Policy helps and where it stops, and how vendor guardrails (on Pro) let you keep a vendor but stop it reading the card field.
Full answer: What Is Formjacking? The Attack and How to Stop It
Transcript
Formjacking is an attack where malicious JavaScript takes control of a web form, so whatever a visitor types is copied to an attacker. It can hit any form, but it's most associated with card numbers at checkout. The name describes the mechanism, not the target. So it can hit any form worth stealing from: a checkout, a login, an insurance quote, a patient intake form. Card forms get the most attention because card data resells immediately. You'll hear three names for this. Formjacking is the mechanism. Web skimming is the outcome. Magecart names the groups. They describe the same incidents. There are two ways it's done. The first listens to your real form, reading the inputs as they're typed or submitted. The form really is yours, so the page looks correct. The second replaces your form with an identical one the attacker controls. It collects the card, then passes it on, so the purchase completes and the customer gets their order. Nothing looks wrong. Why does it work? Any script on a page can read any input on that page. There's no boundary between the code you wrote and the script your analytics vendor's vendor loaded. And it doesn't need your servers. The usual route is a compromised third-party script or tag manager, so your logs show nothing wrong. Each variant leaves a signal. A script reading payment fields. A form that differs from the one your app rendered. A new outbound destination. A script nobody approved. Or an approved script whose code changed. Can a CSP stop it? Partly. It can block an unlisted origin and restrict where data is sent. It can't tell you that an allowed script is reading your card field. Once you find it, block it at the level that fits: one script by its URL, a host or domain, or everything a vendor serves. If the business needs that vendor, allow it but limit what it can do, like reading form fields. Script Monitoring watches every script on your checkout, in every session, and flags the ones that read forms or send data somewhere new. It's free for 1,000 page views a month, and Pro starts at $99 a month. Start for free at scriptmonitoring.com.