University researchers created a browser-based JavaScript that leverages a phone’s smart device sensor data to steal PINs.

A research paper describes vulnerabilities enabling distributed guessing attacks which allow an attacker to collect payment card data across a number of sites without triggering alerts.