JA EN
shiichan

Is That Storefront's JavaScript Really Safe? What Cloudflare Client-Side Security Found in 4 Attacks

Cloudflare Blog ★★★ View Markdown
#cloudflare#security#ai

Hello, it's me, Shiichan! Today I've got a security story that gave me chills.

Cloudflare Blog blog.cloudflare.com

What was announced?

This comes from the Cloudflare Blog. It's a deep dive into how Cloudflare's Client-Side Security (Page Shield's machine learning models) caught 4 malicious JavaScript campaigns running quietly behind storefronts that otherwise looked completely fine.

Why it matters

Modern online stores can look perfectly healthy while malicious JavaScript siphons revenue, hijacks clicks, or rewrites analytics data behind the scenes. Of the 8 malicious payloads featured in the post, 7 weren't registered with VirusTotal, and none of the 8 were flagged as malicious by URLScan. Traditional scanners that only look at URLs or hashes can miss attacks like these entirely.

That's why Cloudflare parses JavaScript as a graph built from its syntax tree, rather than as plain text, using a graph neural network (GNN). When the GNN flags under 0.3% of everything it analyzes as suspicious, a subset gets re-checked by an LLM running on Workers AI, and the hardest cases go to a teacher model that classifies them by voting across 6 families of frontier models.

What changes

Thanks to this pipeline, Page Shield's ML caught all 8 of those payloads. Because it looks at behavior rather than static signatures, it can catch attacks designed specifically to slip past signature-based defenses.

Dive Deep

The 4 campaigns highlighted in the post each use surprisingly elaborate tricks:

  • After-hours affiliate hijacking: tapping a product on mobile opens an attacker-chosen page in a new tab while redirecting the original tab through a fraudulent affiliate link. It uses the MutationObserver API to watch for product tiles added later, sets a 3-day cooldown in localStorage, hides the console with self-defensive checks, and was delivered through a legitimate Google Tag Manager container.
  • Clickless affiliate theft: an off-screen iframe fires affiliate requests automatically without any user click. It requests a response from an IP geolocation API but ignores the actual data, uses an Asia/Kolkata timezone calculation to pick one of 3 TradeDoubler configurations, and sets a one-hour cookie to suppress retries.
  • A search-saboteur turned storefront backdoor: what started as code that disrupted search results evolved into a backdoor that can download and run arbitrary JavaScript from a remote server. It still uses the old trick of watching for search terms like "virus" or "popup" and going quiet if it detects scrutiny.
  • Paid-traffic-only cloaking: only mobile visitors who pass a stack of gates — viewport under 477 pixels wide, within the first 2 page loads, a required UTM tag, and a match against 325 IP substring entries — get targeted. For them, it removes 9 monitoring tools including Lucky Orange and New Relic, swaps out the Google Ads ID, and tracks visitors with a cookie valid for 600 days.

Wrap-up

  • The Cloudflare Blog detailed 4 malicious JavaScript campaigns caught by Client-Side Security (Page Shield's ML).
  • Of the 8 payloads examined, most evaded VirusTotal and all evaded URLScan, yet Page Shield's ML caught every one.
  • The key is a multi-stage pipeline: a GNN that analyzes JavaScript as a graph, followed by LLM review and a multi-model voting classifier.
  • Every campaign hid behind layered conditions based on device, time, geography, or traffic source.
  • Worth reading for storefront operators and front-end security engineers alike.

Related posts