What it is
Web skimming is a family of client-side attacks in which injected JavaScript steals form or payment data and exfiltrates it to an attacker-controlled domain. Magecart is the best-known sub-group, formjacking is the technique, and the skimmer is the script itself. In 2024–2026 the dominant variants hide in service workers, WebAssembly blobs, and lazy-imported chunks, activating only for real sessions that pass an anti-analysis check.
Real-world examples
- Magecart campaigns targeting Magento and WooCommerce.
- Service-worker skimmers that survive page reloads.
- Steganographic payloads hidden inside PNG/SVG files.
How ExploitShield detects it
ExploitShield re-renders monitored pages in real Chromium every 5 minutes, runs a synthetic checkout, records every JS body, and checks every outbound POST destination against 500+ blocklists and skimmer-endpoint heuristics.