Malicious JavaScript is web code embedded in a page or loaded from a remote source to do something harmful or deceptive instead of serving normal site functionality. It can inject fake prompts, redirect visitors, fingerprint a browser, pull down additional content, or trigger scripts that lead to malware delivery. Because JavaScript runs in the browser, it can make a trusted-looking page act as an attack platform without immediately dropping a file on the victim’s device.
In cyber security, this matters because the browser is often the first execution environment an attacker can influence. Malicious JavaScript is common in compromised websites, phishing pages, malvertising, and drive-by delivery chains. Defenders look for injected script tags, unexpected external domains, obfuscated code, and pages that push users toward risky actions such as copying commands into a shell. Web application hardening, content security policy, monitoring, and script integrity checks can reduce exposure and make this kind of abuse easier to detect.