JavaScript Form Field Capture on Login Page

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects JavaScript code being delivered to a client that attempts to capture form field data, specifically looking for 'document.querySelector', 'password', and 'fetch(' within HTTP response data. This behavior is indicative of an attempt to exfiltrate credentials from a login page.