When a victim who is shopping at a compromised online store goes to the checkout page, there will be additional fields injected in the contact form that aren’t normally there.
Source: cyware.com