Buying products or services online always comes with a measure of risk. Does the business properly secure and store credit card data? Does it take steps to protect against cyberfraud?

While most companies recognize the need for PCI DSS-compliant policies and safe data handling, a recent CSO Online article noted another rising risk: malicious JavaScript. Nearly 6,000 online shops have been compromised by this code, which is specifically designed to intercept and steal payment card information.

Is Malicious JavaScript a Long-Term Threat?

This isn’t a new threat. Back in 2015, Dutch researcher Willem de Groot reported these online skimming tactics at more than 3,500 stores. But despite his warning, the situation hasn’t improved. The total number of affected stores has nearly doubled, and of the 3,500 originals, 750 are still putting customer credit card data at risk.

Here’s the problem: This malicious JavaScript not only targets pages with “checkout” in the URL, but also goes after payment plugins like Fire Checkout and PayPal to swipe consumer data. It’s deployed using known vulnerabilities in content management and e-commerce platforms to effectively get behind both HTTP and HTTPS-protected sites and grab information, but many companies don’t recognize the seriousness of the issue.

Some claim that since payments are handled by third parties, it’s not their problem, while others rely on HTTPS to safeguard their interests. But since this JavaScript is installed behind HTTPS at the server level, all information users enter into the checkout page is up for grabs. While 334 stores fixed their issues after the news broke last week, 170 new stores were later hacked.

Laying Down the Law

So how do companies protect their credit card data from malicious JavaScript and other attacks? They can start by recognizing that no e-commerce service is truly safe. Known vulnerabilities open holes for malware to slip through, and attackers are always looking for new ways to compromise lucrative payment portals.

In addition, companies need to consider the use of reliable third-party monitoring and detection tools that can alert them to possible avenues of compromise and help limit their total risk — an essential step given the increasing regulation of personal data storage, transmission and security.

Better consumer data protection will also demand more active involvement from big players in the online space. As noted by Fox Business, for example, search giant Google is rolling out a new policy as of January 2017: Any HTTP site that transmits credit card information or passwords will be considered insecure by the company’s Chrome browser.

Right now, HTTPS sites are displayed as secure and HTTP sites as neutral. Raising the threat profile on HTTP-only checkout processes should improve customer awareness and prompt greater demand for secure checkout options.

Financial data remains a high-value target for cybercriminals. Malicious JavaScript is simply the newest tool used to crack credit card information, and it reinforces the need for more active monitoring and supervision of e-commerce sites by sellers and payment processors alike.

It’s a reminder that there’s no resting on one’s laurels here, since even HTTPS is of no use if cybercriminals infect the servers directly. Companies, third parties and dominant online entities need to collectively tackle these sneaky swipers head on.