When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
Cloudflare's Page Shield ML uncovered four malicious JavaScript campaigns on storefronts, including affiliate fraud and a remote-backdoor script, that VirusTotal and URLScan missed.
Cloudflare's Page Shield ML detected four client-side JavaScript operations (eight payloads) in live traffic on online storefronts, enabling affiliate commission hijacking, clickless affiliate theft via hidden iframes, user tracking with a remote-code backdoor, and cloaking of paid mobile visitors. Seven of the eight payloads were absent from VirusTotal and URLScan returned no malicious verdict for any, including a Lnkr-family payload indexed unclassified for roughly 2.5 years. Detection relies on a graph neural network over JavaScript syntax trees, an LLM second opinion on Workers AI, and a frontier-model ensemble voting across benign, magecart, other malware, and cryptomining labels.
- Seven of eight payloads were absent from VirusTotal; URLScan gave no malicious verdict for any.
- A Lnkr-family payload sat on URLScan unclassified for about 2.5 years before ML flagged it live.
- Behaviors include affiliate commission theft, hidden-iframe auto-clicking, telemetry, and remote JavaScript loading.
- Pipeline combines a GNN, an LLM second opinion, and weighted frontier-model ensemble voting.
- Previously the same GNN caught malicious npm packages and an in-the-wild Magecart skimmer.
- ATT&CK
- T1059.007 JavaScript/JScriptT1056 Input CaptureT1105 Ingress Tool TransferT1564 Hide Artifacts
- Vendors
- Cloudflare
- Products
- Page Shield
- Organizations
- Cloudflare
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | adtarget.com | plain sight: adtargett[.]com differed by a single “t” from adtarget[.]com , an advertising domain registered in 1998. The lookalike |
| domain | adtargett.com | ick marketing review. One delivery host hid in plain sight: adtargett[.]com differed by a single “t” from adtarget[.]com , an adverti |
| domain | buking.com | ink rewriters, and redirects for typosquatted domains, like buking[.]com instead of booking[.]com ) only wake up on specific targe |
| domain | cdnpps.us | Several embedded domains ( sugabit[.]net , votetoda[.]com , cdnpps[.]us , and telemetry endpoint hanstrackr[.]com ) sat inside th |
| domain | hanstrackr.com | net , votetoda[.]com , cdnpps[.]us , and telemetry endpoint hanstrackr[.]com ) sat inside these disabled modules. On the shop, the act |
| domain | jullyambery.net | domain names ( scrprime[.]com , youronlinesearches[.]com , jullyambery[.]net ) remained identical to older captures, what those endpoi |
| domain | scrprime.com | to change its behavior. While the hardcoded domain names ( scrprime[.]com , youronlinesearches[.]com , jullyambery[.]net ) remained |
| domain | sugabit.net | d turned off on this storefront. Several embedded domains ( sugabit[.]net , votetoda[.]com , cdnpps[.]us , and telemetry endpoint h |
| domain | votetoda.com | this storefront. Several embedded domains ( sugabit[.]net , votetoda[.]com , cdnpps[.]us , and telemetry endpoint hanstrackr[.]com ) |
| domain | youronlinesearches.com | havior. While the hardcoded domain names ( scrprime[.]com , youronlinesearches[.]com , jullyambery[.]net ) remained identical to older capture |
From the original article
14 min read at blog.cloudflare.com
A modern storefront can look healthy while malicious JavaScript quietly siphons revenue, hijacks clicks, or rewrites analytics. See how Cloudflare's machine learning models surface evasive client-side attacks for analyst investigation.
By Juan Miguel Cejuela · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.