What it is
A service worker is a script the browser runs in the background, separate from the page, and able to intercept network requests. Attackers register a malicious service worker (often via an innocuous-looking analytics.js wrapper) to keep a skimmer active across navigations and reloads. Because the code lives outside the page's DOM, static scanners and signature matching typically miss it.
Real-world examples
- A payment-page skimmer registered inside a service worker.
- Fetch interception for silent form-data exfiltration.
- A persistent payload activated only after a fingerprint check.
How ExploitShield detects it
ExploitShield's crawler launches a fully instrumented Chromium with service-worker hooks, runs a synthetic checkout, and records every fetch initiator in the resulting page tree — capturing the payload exactly when it fires for a realistic-looking session.