Formjacking.

An attack in which malicious JavaScript intercepts form submissions in a victim's browser and sends the entered data to a server controlled by the attacker. It belongs to the Attacks & Threats category of cybersecurity.

An attack in which malicious JavaScript intercepts form submissions in a victim's browser and sends the entered data to a server controlled by the attacker.

Formjacking targets any HTML form — login, checkout, account update — by hijacking its submission flow in the user's browser. The attacker compromises a vulnerable web application, an admin account, or a third-party script (chat widget, analytics, A/B-test tool) and inserts JavaScript that hooks the form's submit event or keyup handlers. Captured credentials, card numbers, addresses, or PII are exfiltrated to a remote endpoint while the legitimate request still completes, so users notice nothing. Magecart and the British Airways breach are textbook formjacking. Defences include Content Security Policy, Subresource Integrity, runtime client-side monitoring (Akamai Page Integrity, Jscrambler), and the PCI DSS v4.0 client-side script-integrity requirements.

Defences for Formjacking typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Form skimming, Client-side form theft.