Beware of formjacking

Cyberattack which includes details like credit card numbers, login credentials, or personal identification data to steal the information is known as formjacking

Formjacking is a type of cyberattack in which hackers inject malicious code into a website’s forms, such as payment forms or login pages, to steal sensitive user information. This can include details like credit card numbers, login credentials, or personal identification data.

Mechanism: Hackers gain access to a website and insert malicious scripts, typically JavaScript, into its forms.

---

When a user submits their information on the form, such as during a payment or login process, the malicious code quietly captures the data.

The captured data is sent to an external server controlled by the attackers without the knowledge of either the user or the website owner.

The attackers may later use this stolen information for identity theft, fraud, or other illegal activities.

Formjacking is difficult to spot because it doesn’t require a complete website breach.

The attack targets the form itself, meaning the rest of the site may remain intact and functional.

As a result, users may not realise they have been compromised until fraudulent activities occur.

Safety measures: To defend against formjacking, it is crucial to implement secure coding practices, conduct regular security audits, and use technologies like Content Security Policy (CSP) to limit unauthorised code execution.

Ensure websites are legitimate and secure before entering sensitive information. Look for ‘https’ in the URL and the padlock icon in the address bar.

Avoid using public Wi-Fi for entering sensitive data, and remain cautious about phishing attempts or suspicious communications that could follow a formjacking attack.