Defacement is loud and gets noticed within the hour. Script injection is quiet, and can run for months. If the goal is to identify who reads a human rights organisation’s site rather than to embarrass it, the quiet option is obviously better.
What gets injected
- A third-party analytics tag you did not add, reporting to a domain you do not recognise.
- A one-pixel image loading from an unfamiliar host on every page view.
- A fingerprinting script bundled into a legitimate-looking library file.
- A modified contact form that quietly copies submissions to a second endpoint.
The last one is the most damaging and the hardest to spot, because the form keeps working exactly as it should. The only visible difference is one extra outbound request, and nobody is watching outbound requests on a Wednesday.
A form that still works is not evidence that a form has not been tampered with.
Detection you can run yourself
- Open the site in a clean browser profile and read the network tab. Every third-party domain should be one you can name.
- Set a Content Security Policy. It both blocks injection and reports attempts.
- Use Subresource Integrity for any script you load from someone else’s server.
- Diff your published assets against source control. Unexplained drift is the whole signal.
- Alert on changes to the form handler specifically, since it is the highest-value target on most sites.
This is precisely the class of change that continuous monitoring catches and a quarterly review does not. By the time a review runs, the list has already been collected.