of such snippet are detailed below the first is javascript based and the second is pure html the url accessed https www service site path can redirect to a different url the final url may contain strings that would trigger the malware i e if the malware only performs html injection on pages whose urls contain the string u201c logintobank u201d then the page at https www service site path can redirect to e g https www service site path foo logintobank amp bar 123 which is enough to trigger the malware the page at https www service site path contains html to further trigger html injection by the malware for example if the malware searches for u201c username lt input type text gt lt br gt u201d and appends u201c atm card pin lt input type password gt lt br gt u201d to it then the html page at https www service site path may contain the following in this case the whole page contents are sent to https www service site analyze where they can be analyzed the server page https www service site analyze can for example search for the string u201c atm card pin lt input type password gt lt br gt u201d inside the page which is an indication for malicious activity inside the browser or.