AI-generated editorial illustration; not a documentary photograph.
Cloudflare says its Page Shield machine-learning system detected eight malicious JavaScript payloads used across four operations targeting online storefronts. According to the company, seven payloads were absent from VirusTotal when it reviewed the campaigns, while URLScan had not issued a malicious verdict for any of them.
Attacks hid behind normal storefronts
The scripts were designed to remain inconspicuous while stores continued loading products and processing purchases. Their reported behavior included redirecting affiliate attribution, generating covert affiliate requests, intercepting searches or clicks, suppressing monitoring and conditionally retrieving additional code from remote servers.
Some payloads activated only when conditions involving device type, time, browser state or user interaction were satisfied. Cloudflare found variants that used cooldowns lasting several days, hidden iframes and dynamically attached click handlers, making the behavior difficult to expose through a brief or one-time page scan.
Affiliate fraud and remote control
One operation intercepted qualifying product taps and routed the original browser tab through an attacker-controlled affiliate link while opening another product page in a new tab. Cloudflare said this could overwrite legitimate referral attribution and lead stores to credit commissions to an account that did not produce the sale.
Another script attempted to trigger affiliate requests without a shopper clicking an advertisement, primarily through an off-screen iframe. Cloudflare observed the automated requests but said it could not determine whether they resulted in completed attribution, credited accounts or commission payments.
A separate payload based on the previously documented Lnkr family was embedded directly in a retailer's HTML. Its storefront behavior included sending telemetry and providing a mechanism to download and execute remote JavaScript. Cloudflare could not determine how the script was initially inserted.
How Page Shield evaluates scripts
Page Shield analyzes JavaScript with a graph neural network that models code structure instead of relying solely on known URLs or file signatures. Cloudflare says fewer than 0.3% of analyzed scripts are flagged as malicious and sent to a lightweight large language model on Workers AI for a second assessment before customers are alerted.
More complex cases are evaluated by models from about six families, including open-weight models, with their votes weighted using the Artificial Analysis Intelligence Index. Human reviewers examine scripts classified as malicious or lacking a two-thirds majority. Cloudflare says this feedback is used for further model training, although the process remains partly manual.
Source: When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
SIGNAL TITANS
Leave a Reply