Magecart
Family of attacks against e-commerce — inject JS into checkout pages to steal credit card details.
British Airways, Ticketmaster, Newegg were hit. Often via supply chain — compromised third-party libraries (analytics, A/B testing). Defences: SRI on external scripts, CSP, no unnecessary 3rd-party scripts on payment pages.