Loading story…
Organizations pursuing PCI DSS compliance are being warned that compliance controls alone do not prevent client-side payment data theft, particularly when third-party scripts and outsourced payment flows are involved. Commentary highlights that changes to PCI DSS v4-related guidance (including updated SAQ A language for merchants using PCI-compliant payment service providers) can reduce mandated anti-skimming requirements, increasing the risk that merchants “trust but don’t verify” protections around browser-executed code and third-party dependencies.
Separately, tokenization guidance emphasizes that tokenization is distinct from encryption and is intended to reduce exposure by replacing sensitive values (e.g., PANs) with non-sensitive tokens, potentially reducing PCI scope when implemented correctly. The same guidance cautions that implementation pitfalls are common and that using encryption as a stand-in for tokenization can leave organizations at risk—reinforcing that data protection architecture (e.g., tokenization) and client-side/script visibility controls address different parts of the payment-data threat surface, and both may be necessary to mitigate modern skimming techniques such as MirrorMask targeting select Stripe merchants via script/API redirection and reverse-proxy interception.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
In April 2025, some merchants using Stripe were targeted by the MirrorMask digital skimmer. The campaign redirected Stripe scripts and API calls to a fake Stripe site and used a reverse proxy to harvest payment data while preserving a normal checkout experience.
In 2025, PCI DSS SAQ A was changed to remove requirements 6.4.3 and 11.6.1 for merchants that outsource payment processing to PCI DSS-compliant payment service providers. The change reduced explicit anti-skimming and script-monitoring obligations for those merchants under SAQ A.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a **Magecart-style web skimmer** planted in a compromised online store, where malicious JavaScript injected a fake payment form into the checkout process, captured card data as customers typed it, and exfiltrated the information to an attacker-controlled server disguised as an image request. The skimmer used **anti-debugging**, adaptive field mapping, and `localStorage` persistence to evade detection and maintain access, with reported indicators including `gstatis.co` and `185.215.113.111`. Separate reporting on a major Japanese case described a similar **web skimming** intrusion in which attackers embedded heavily obfuscated code into an existing site JavaScript file, potentially exposing data from more than **100,000 records**. Analysts said **Content Security Policy (CSP)** would not have stopped delivery of the tampered first-party script, but could have blocked exfiltration to `www.javascriptworld.xyz/isSafe.php`, underscoring that digital skimming attacks increasingly target payment applications by stealing data in the browser rather than breaching backend databases.
Jul 7, 2026
Web applications face significant risks from client-side attacks such as Cross-Site Scripting (XSS), where malicious scripts are injected into trusted websites and executed in users' browsers. Attackers exploit vulnerabilities by compromising third-party services, injecting code through adverts, or leveraging XSS to steal sensitive data like session tokens and credit card information. These attacks often bypass traditional security tools, which primarily monitor server-side activity and sanitized data, leaving organizations exposed to threats that manifest in the user's browser environment. Content Security Policies (CSPs) are commonly implemented as a baseline defense for client-side security, restricting the sources from which scripts can be loaded. However, CSPs cannot inspect the actual content of scripts or detect if a trusted script has been altered to become malicious. As a result, CSPs alone are insufficient for full compliance with standards like PCI DSS, which require monitoring for script changes. Organizations must recognize the limitations of both traditional security tools and CSPs, and consider additional measures to detect and prevent sophisticated client-side threats.
Jul 12, 2026
Security researchers and industry experts have highlighted significant risks associated with client-side JavaScript in modern web applications, emphasizing the limitations of traditional server-side defenses. A penetration tester discovered a reflected cross-site scripting (XSS) vulnerability in a critical web application, demonstrating how attackers can inject malicious scripts through user-modifiable fields, such as a license name, even with low-privilege accounts. The tester noted that while certain security measures like the HttpOnly cookie flag can prevent classic cookie theft via JavaScript, other attack vectors remain viable, especially when input validation is insufficient. Industry reports have shown that during peak shopping seasons, such as the holidays, attacks targeting client-side code have surged, with incidents like the Polyfill.io breach and Magecart attacks affecting hundreds of thousands of websites and compromising payment data. These attacks exploit the fact that web application firewalls (WAFs) and intrusion detection systems are blind to JavaScript execution within users' browsers, creating a significant visibility gap. The encrypted nature of modern web traffic further complicates detection, as network monitoring tools cannot easily inspect data sent to third-party domains. Security experts warn that compliance tools and client-side security agents, such as JavaScript monitoring scripts and Content Security Policy (CSP) headers, can often be bypassed by attackers using well-known browser behaviors and design limitations. Techniques to evade these controls include manipulating JavaScript agents, circumventing CSP restrictions, and avoiding detection by automated crawlers. The effectiveness of these bypasses underscores the need for organizations to rigorously test their client-side security and compliance tools, rather than relying solely on checkbox compliance. Defensive recommendations include adopting more robust monitoring of third-party scripts, implementing layered security controls, and ensuring responsible disclosure of discovered vulnerabilities. The evolving threat landscape requires organizations to address both server-side and client-side risks, as attackers increasingly target the browser environment where traditional defenses are ineffective. Security professionals advocate for a proactive approach to client-side security, including regular penetration testing, comprehensive monitoring, and continuous improvement of defensive measures. The combination of real-world vulnerability discoveries and industry-wide attack trends demonstrates that client-side security remains a critical and often underappreciated aspect of web application defense. Organizations are urged to close visibility gaps and strengthen their client-side protections to prevent data theft and maintain customer trust. The ongoing evolution of attack techniques necessitates vigilance and adaptation in both technical controls and security policies.
Jul 12, 2026