A web injector is malware, or a malicious module, that inserts code into a live browser session to change web content or browser behavior. Instead of attacking the server, it operates on the client side: it can run JavaScript, alter form fields, hide or replace page elements, and steal session cookies. This is often called a man-in-the-browser style attack because the browser is being manipulated while the user is still logged in.
Web injectors matter because they can turn a valid session into fraud. In banking, for example, an injector may replace an account number or payment destination at the moment of transfer, capture authentication data, or change what the user sees before confirmation. Defenders look for unusual script activity in browser processes, suspicious access to cookie stores, unexpected extensions or injected code, and last-minute changes in payment details. Short-lived sessions, phishing-resistant MFA, transaction signing, and out-of-band verification help reduce the impact.