Cloudflare ML detects 4 hidden client-side malware campaigns

Client-side malware on e-commerce sites can operate undetected for years, siphoning revenue and data while storefronts appear functional. Cloudflare’s Page Shield machine learning system recently uncovered four such operations, comprising eight malicious JavaScript payloads that evaded public security scanners like VirusTotal and URLScan. The findings highlight gaps in traditional signature-based detection and the need for continuous, behavior-aware monitoring of browser-executed code.

How the attacks evaded detection

The eight payloads were not flagged by VirusTotal or URLScan despite some being publicly accessible for over two years. One payload from the Lnkr malware family, for example, remained unclassified on URLScan for nearly 30 months, including during a direct scan in January 2024. VirusTotal later marked it as malicious, but the timeline of that verdict remains unclear. Cloudflare’s system, by contrast, detected all eight payloads in live traffic by analyzing JavaScript behavior rather than relying on known signatures or URLs.

The campaigns employed diverse evasion tactics. Some scripts activated only under specific conditions—such as mobile devices, certain geographic regions, or particular times of day—while others used invisible iframes or self-clicking links to execute affiliate theft without user interaction. One operation even disguised its delivery domain as a legitimate marketing agency, using typosquatting to blend in with routine third-party tags. These techniques allowed the malware to remain dormant during automated scans, only activating when real users visited the site.

The four operations and their impact

Each campaign targeted different aspects of e-commerce operations:

1. After-hours affiliate hijacker: Intercepted product clicks on mobile devices during specific time windows, redirecting users through attacker-controlled affiliate links. The script used a three-day cooldown to avoid repeated execution on the same device, while MutationObservers tracked dynamically loaded product tiles to ensure late-arriving elements were also hijacked.

2. Clickless affiliate theft: Sent covert affiliate requests via hidden iframes or auto-clicked links, bypassing user interaction entirely. The script ignored geolocation data from its own IP lookup, instead using hardcoded time gates to determine when to execute. A one-hour throttle cookie prevented rapid re-firing, while a fallback mechanism clicked hidden links if the iframe failed.

3. Search saboteur turned backdoor: Originally part of the Lnkr malware family, this script repurposed dormant search-redirect modules to open a remote backdoor on a retailer’s site. It sent telemetry to attacker-controlled domains and could load arbitrary JavaScript without modifying server files. Anti-analysis features, such as pausing execution when security-related keywords were detected, further obscured its behavior.

4. Paid-mobile cloaker: Targeted high-value mobile traffic from paid campaigns, disabling analytics tools, support chats, and ad attribution systems. The script used a 325-entry IP denylist and geographic filters to avoid triggering on corporate networks or security analysts’ devices. It also replaced legitimate ad publisher IDs with attacker-controlled ones, potentially diverting revenue.

Why continuous monitoring matters

The campaigns demonstrate that static scans and one-time crawls are insufficient to detect client-side malware. Many scripts remained dormant unless specific conditions were met—such as device type, time of day, or geographic location—making them invisible to traditional security tools. Cloudflare’s approach combines a graph neural network (GNN) to analyze JavaScript structure with a lightweight LLM for secondary validation, reducing false positives while maintaining high detection rates.

For complex cases, the system employs an ensemble of frontier AI models to analyze suspicious scripts independently. Disagreements between models are treated as signals, with human reviewers focusing only on scripts lacking a clear consensus. This feedback loop helps refine detection over time, particularly for heavily obfuscated payloads.