In a recent attack spotted by the Source Defense Cyber Research team, a compromised first-party script on a payment page stored sensitive data in a cookie named csp_f_y. The exfiltration didn’t happen immediately—it was triggered on the next page load using location.href, slipping past content security policies (CSP) that would have otherwise blocked malicious outbound requests.
