A Cloudflare post says its Client-Side Security system found four malicious JavaScript campaigns hiding inside otherwise normal-looking storefronts, including affiliate hijacking, covert tracking and a browser backdoor. The company says Page Shield ML caught all eight payloads in live traffic, while common scanning tools missed most of them, underscoring how browser-based attacks can stay invisible even when a site appears to work perfectly.
Why Cloudflare says scanners were not enough
Cloudflare’s central point is simple: a storefront can load, display products and complete checkout while malicious code quietly changes what the browser does behind the scenes. The company says the malicious payloads it identified were not discovered by a signature match or a known bad URL alone, but by machine learning that analyzed JavaScript behavior in live traffic.
In the company’s review of the campaigns, seven of the eight payloads were absent from VirusTotal, and URLScan returned no malicious verdict for any of them. Cloudflare says Page Shield ML detected all eight before humans verified the findings, which is the kind of gap defenders worry about when attacks are built to stay quiet unless a very specific visitor, device or time window is present.
How Cloudflare Client-Side Security works
Cloudflare describes its detection stack as a graph neural network, or GNN, that does not treat JavaScript as plain text. Instead, it reads the code as a graph, following how functions connect, what is called, what is hidden and where the script phones home. That approach is designed to survive minification, renaming and some forms of obfuscation.
The company says fewer than 0.3% of analyzed scripts are flagged as malicious by the GNN, and those are sent to a lightweight large language model on Workers AI for a second opinion. If the LLM agrees, customers are alerted. For the most complex cases, Cloudflare also uses a cohort of frontier models, which it calls teachers, to vote on whether the script is benign, payment skimming, other malware or cryptomining.
A layered analysis pipeline
- GNN analysis to spot suspicious JavaScript structure and behavior
- LLM review for a live second opinion on the scripts flagged by the model
- Frontier-model “teachers” for harder samples and disputed labels
- Human review for malicious scripts or cases without a clear two-thirds majority
Cloudflare says the label distributions from those reviews are fed back into GNN training, so the system improves over time. The company also says it plans to extend the workflow with Cloudflare Sandbox for deeper analysis in isolated environments.
The four campaigns Cloudflare found
The post breaks the detections into four operations, each with a different goal. Some were aimed at stealing affiliate commissions, while another turned a retailer’s site into a remote code execution backdoor inside customers’ browsers. A fourth focused on cloaking and suppressing analytics on paid mobile traffic.
1) After-hours affiliate-commission hijacker
This campaign targeted mobile shoppers and intercepted clicks on product elements. Cloudflare says the script could open a product page in a new tab while routing the original tab through an affiliate link, allowing an attacker to claim credit for sales that did not originate from them.
The behavior was heavily gated. Cloudflare found five related builds, two active and three paused, with checks for device type, time, cooldown state and whether product buttons had appeared. The active versions used a MutationObserver to watch for dynamically rendered product tiles and only acted when the right conditions were met.
2) Clickless affiliate theft
The second operation went further by triggering an affiliate request without requiring a user click. Cloudflare says the script used an off-screen iframe as its main delivery path, with a fallback that could click a hidden link programmatically if the iframe failed.
To avoid repeated firing, the script wrote a one-hour retry throttle to a local cookie. Cloudflare also says the code ran through time gates, browser-state checks and a geolocation fetch that appeared to be used more as a control mechanism than for actual location data. If the request did not fit the script’s schedule, it remained dormant.
3) The old search saboteur turned storefront backdoor
Cloudflare says the third operation repurposed code from the Lnkr malware family, which had previously been associated with browser-extension abuse and search-result hijacking. On the storefront, older search-related modules stayed dormant, but active branches were used for telemetry and remote code loading.
Most notably, the script gave the attacker a path to download and execute fresh JavaScript in a shopper’s browser without changing the server-side site code. Cloudflare says that turned the storefront into a live backdoor, letting the attacker alter behavior at will after the page had loaded.
4) The paid-mobile cloaker
The fourth campaign focused on mobile visitors arriving through paid or tagged marketing traffic. Cloudflare says the script only ran when the visit matched a long list of conditions, including the target host, a narrow viewport, specific UTM tags and a limited page-count window.
Once active, it tried to disable nine monitoring and analytics tools, replace advertising and analytics identities and emit tracking beacons. Cloudflare says the code also used a 325-entry IP substring list and other gates to avoid cloud systems, corporate networks, VPNs and security researchers.
What these attacks show about browser visibility
The common thread across all four operations is selective execution. These payloads were not written to behave loudly every time; they were written to wait for the right victim, then act in ways that would be easy to miss during a quick scan. That is exactly the kind of behavior that can fool traditional security tools if they rely on known signatures, known bad domains or a single snapshot of page state.
Cloudflare’s report also highlights another uncomfortable reality for retailers: a storefront can be compromised without an obvious outage. Shoppers may still browse and buy, while attribution, analytics, partner commissions and even the code running in the browser are quietly manipulated.
For site operators, the practical lesson is that client-side visibility matters as much as server-side hygiene. A page that looks normal to a human reviewer or a scanner can still be carrying logic that only appears under certain device, timing or traffic conditions.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: September 17, 2026 at 10:34 pm
0 views
