The only client-side security company with a proxy solution. Gain visibility into every 3rd party script, attack, fraud attempt, and AI agent on the client-side
📅 March 26th at 1pm EST | Live Webinar with @csideai!
Join us to learn how issuer expectations are changing, what stronger dispute evidence looks like today, and how to better protect revenue.
Register free: https://t.co/T80vPHcH93
#Chargebacks | #Payments
Observing a surge in client-side fetches happening to msclairty[.]com hijacking referral tokens. Still unclear of the extension responsible but judging by the volume it must be top one of the 5000 browser extensions.
🚨 Magecart Alert 🚨
A live Magecart skimmer on payment pages is exfiltrating credit card data in violation of PCI DSS.
Script downloaded from: hxxps://meriksshadowfiend[.]top/moritz-ca/metrics.js
Sending stolen data to:
hxxps://pixelnotinggo[.]top/api/accept-metrics
A browser extension can quietly remove critical security headers like CSP. No warning. No consent.
You install an extension and suddenly, protections against data leaks and injections are gone.
Should we make this an explicit opt-in?
Or will that see no adoption?
This is what makes client-side attacks so dangerous. Dynamism is a sword that cuts both ways. Attacker leverage this to stay undetected for days, weeks and months.
Yesterday CoinMarketCap got struck by a substantial client-side attack. Impacting all logged in users to reauthenticate their wallet access, and inadvertently grating access to a bad actor.
We analyzed an attack on a Magento-based eCommerce site. The injection technique used hides in plain sight as the attacker is using ‘Google .com’ to deliver and execute their own code.
https://t.co/g6ZNlmtp74
A new attack found in Progressive Web Apps (PWAs). They are browser-based too after all, and are also targets in client-side attacks.
https://t.co/4yNNL5SV7T
If you’re serious about client-side security, you need runtime protection that sees what scripts actually do in your users' browsers.
CSP is like locking your front door while leaving the windows wide open.
"But we use CSP so we're fine"
❌ No, you’re not.
CSP was designed to protect you from things like XSS.
But in reality, a CSP is blind as a bat.
If you trust a vendor’s domain, CSP lets it right through.
If that vendor gets compromised? CSP shrugs.
If you believe “strict CSP” is enough, look at Magecart, PII leaks, or the rise of fake browser updates. CSP couldn't save them, and neither will it save you.