↓ Skip to main content
Juan Carlos Munera
  1. Tags/

Ecommerce Security

The AppsFlyer SDK Hijack: Why PCI DSS 6.4.3 and 11.6.1 Exist

·1754 words·9 mins
PCI-DSS Supply Chain Attack E-Skimming Magecart Client-Side Security AppsFlyer PCI DSS 4.0.1 Web Security Ecommerce Security JavaScript Security Cybersecurity
On March 10, 2026, AppsFlyer’s JavaScript SDK was compromised in an active supply chain attack. If you run an ecommerce site and that script loads on your payment pages, you’ve potentially been serving malicious code to every customer who checked out over the past 72+ hours. No changes to your codebase required. No alerts from your WAF. No red flags on your server logs. This is actively happening. And for anyone who’s been wondering why the PCI Security Standards Council added requirements 6.4.3 and 11.6.1 to PCI DSS 4.0.1, this is your answer.