Injected JavaScript is script code added to a webpage after it has been compromised. Instead of serving the site’s original content, the attacker changes the page in the visitor’s browser by modifying the DOM, rewriting text, adding forms, redirecting traffic, or loading hostile resources from another server.
This matters because the webpage itself becomes part of the attack. Injected scripts can present fake verification pages, steal credentials entered into forms, fingerprint the browser, or trigger downloads and follow-on malware delivery. In real incidents, the code often acts as a trust trap: the site looks legitimate, but the browser is silently running attacker-controlled logic. Defenders look for unexpected script changes, altered hashes, suspicious third-party domains, and violations of Content Security Policy or Subresource Integrity. Treating client-side code as an integrity boundary is essential, because once JavaScript is injected, normal web trust signals can be turned against the user.