Which attack embeds malicious JavaScript that captures session tokens in the background?

Which attack embeds malicious JavaScript that captures session tokens in the background?

• A. Trojan
• B. Malicious JavaScript codes
• C. CSRF Attack
• D. Man-in-the-Browser Attack

Answer: (B)

The scenario tests how in-browser code can steal session tokens by running inside the victim’s browser to exfiltrate data. When JavaScript is embedded or injected into a webpage, it can read tokens stored in cookies or browser storage (if those tokens aren’t protected with HttpOnly) and quietly send them to an attacker. This is the classic behavior of malicious JavaScript code: it executes in the page context and captures sensitive data in the background without the user realizing. A Trojan is a broader term for malware that might enable such abuses, but the question focuses on the method of token theft via browser-executed code, which is best described by malicious JavaScript codes. CSRF relies on using an existing token to perform actions on behalf of the user rather than stealing the token itself. A Man-in-the-Browser attack can also capture data but typically involves a compromised browser environment delivered by malware, whereas the prompt emphasizes the embedded JavaScript running in the page to harvest tokens. To reduce this risk, use HttpOnly cookies, proper input validation, and content security policies to limit and monitor script execution.

The scenario tests how in-browser code can steal session tokens by running inside the victim’s browser to exfiltrate data. When JavaScript is embedded or injected into a webpage, it can read tokens stored in cookies or browser storage (if those tokens aren’t protected with HttpOnly) and quietly send them to an attacker. This is the classic behavior of malicious JavaScript code: it executes in the page context and captures sensitive data in the background without the user realizing.

A Trojan is a broader term for malware that might enable such abuses, but the question focuses on the method of token theft via browser-executed code, which is best described by malicious JavaScript codes. CSRF relies on using an existing token to perform actions on behalf of the user rather than stealing the token itself. A Man-in-the-Browser attack can also capture data but typically involves a compromised browser environment delivered by malware, whereas the prompt emphasizes the embedded JavaScript running in the page to harvest tokens. To reduce this risk, use HttpOnly cookies, proper input validation, and content security policies to limit and monitor script execution.