Webinar Description
Key Takeaways
- Focuses on eSkimming attacks that exploit trusted tag managers, analytics services, and payment scripts
- Covers conditional malicious code execution that evades standard security testing and scans
- Addresses PCI DSS 4.0.1 compliance requirements for sections 6.4.3 and 11.6.1
- Designed for retail security, AppSec, and PCI compliance teams preparing for peak shopping periods
- One hour live webinar format on October 14th, 2026
About the Event
The Holiday 2026 Threat Briefing is a live webinar hosted by Source Defense on October 14th, 2026, from 2:00 to 3:00 PM EST. The briefing translates recent research into actionable guidance for security teams defending against browser-side threats targeting retail, eCommerce, and payment workflows. The session emphasizes risks posed by trusted scripts and services that may behave maliciously after execution, often evading routine security reviews.
Browser-Side Attack Techniques
The briefing examines how attackers leverage trusted tag managers, analytics services, and payment scripts to execute eSkimming attacks. A central theme is conditional code execution, where malicious behavior activates only under specific circumstances, allowing attacks to bypass standard testing environments and security scans. The session also covers fake forms and page manipulation techniques used to compromise hosted payment flows.
PCI DSS 4.0.1 Compliance
The webinar addresses how runtime evidence can support compliance with PCI DSS 4.0.1 requirements, specifically sections 6.4.3 and 11.6.1. These sections relate to script management and change detection on payment pages. The briefing explores how understanding runtime behavior helps teams identify security gaps that script inventories alone may miss.
Security Review Techniques
Attendees will learn security review techniques for checkout, account, and billing processes. The session focuses on identifying unauthorized script behavior that bypasses routine scans and detecting threats that emerge only during actual user sessions rather than in testing environments.
Who Should Attend
The briefing is designed for professionals responsible for securing online payment environments and maintaining PCI compliance. Relevant roles include security analysts, AppSec engineers, PCI compliance officers, IT security managers, and technical leads from retail, eCommerce, and payment processing organizations. The timing positions the content for teams preparing their security posture ahead of the high-traffic holiday shopping season.