A storefront can look normal while the browser is compromised

Cloudflare is highlighting a blind spot in website security: a modern storefront may load normally, display products and complete checkout while malicious JavaScript performs unauthorized actions in the background. According to the company, such code can siphon affiliate revenue, hijack searches and clicks, tamper with analytics or contact a remote server to determine what code should run next.

The company says its Client-Side Security machine learning model, part of Page Shield, was designed to expose this behavior by examining scripts in live browser traffic. In a review described in the Cloudflare Blog, the system uncovered four operations involving eight malicious payloads. Detection was automated, while human researchers verified the findings after the system raised alerts.

Cloudflare said subsequent checks with common security-scanning services produced a significant gap. Seven of the eight payloads were entirely absent from VirusTotal, and URLScan returned no malicious verdict for any of them. The company argues that waiting for a known hash or an external classification can leave a retailer exposed after the code is already active on its site.

Why one-time scanning misses evasive code

The four operations did not share a universal signature or a single concealment technique, Cloudflare said. One remained dormant unless conditions such as the device, country, time, referrer or browser state matched its targets. Another placed a clickless affiliate request inside an invisible iframe. Other scripts intercepted clicks, suppressed monitoring or conditionally loaded more code from remote servers.

That behavior makes a single page inspection insufficient. Security teams need to observe when a script activates, what it hides, which user actions it intercepts and what it fetches afterward. Cloudflare said ongoing browser visibility is therefore important because these scripts are built to remain quiet until a qualifying visitor appears.

The company cited one version of the broader Lnkr family as an example. Although security research had documented the family years earlier, Cloudflare said a specific payload remained indexed by URLScan for nearly two and a half years with a status of no classification, including during a direct scan in January 2024. VirusTotal currently flags that script as malicious, but its public history does not show when the verdict was first assigned.

Page Shield uses a graph view of JavaScript

At the center of the detection process is a graph neural network, or GNN. Cloudflare said the same model had previously detected malicious npm packages and an in-the-wild Magecart payment skimmer. Rather than treating JavaScript as a flat block of text, the GNN represents it as a graph built around the syntax tree.

This structure allows the model to reason about relationships between code symbols, including which functions call one another, what an attacker attempted to conceal and which parts of the script communicate externally. Cloudflare said that approach helps identify suspicious behavior across minification, renamed symbols and some forms of obfuscation without depending on a known URL or byte signature.

The GNN flags fewer than 0.3% of analyzed traffic as malicious, according to the company. Those scripts are then sent to a lightweight large language model running on Workers AI for a live second opinion. Cloudflare said this additional step is intended to reduce false positives while preserving detection coverage, with customer alerts issued when the LLM corroborates the GNN.

Automated judges help investigate difficult cases

For more complex scripts, Cloudflare uses a group of frontier models it calls teachers. The cohort includes leading models from about six families, including open-weight models running on Workers AI. Each model is launched as an agent in a fresh, independent session to analyze the same suspicious script.

When useful, the agents can access a restricted JavaScript evaluator to unpack small snippets and expose concealed behavior. Cloudflare said it plans to extend this workflow with Cloudflare Sandbox for deeper analysis in isolated environments.

The models may disagree, particularly when scripts are intricate. Cloudflare treats that disagreement as a signal and combines the results into a probability distribution covering four labels: benign, payment skimming or Magecart, other malware and cryptomining. Each vote is weighted by the model's score in the Artificial Analysis Intelligence Index.

Human reviewers focus on scripts labeled malicious or those without a clear two-thirds majority. The resulting label distributions are fed back into GNN training so the model can improve its handling of nuanced behavior. Cloudflare acknowledged that this feedback loop remains partly manual, although some of the process is beginning to be automated.

Four operations, different objectives

Cloudflare's examples illustrate why a model trained to recognize only one attack category could miss others. The company described an after-hours affiliate-commission hijacker that targeted mobile visitors and used time gates, dynamic page monitoring and click interception. When a qualifying shopper tapped a product, the script could open an attacker-selected product or campaign page in a new tab and send the original tab through an affiliate route.

The storefront could still appear to work, but a later purchase might be attributed to an account that did not earn the referral. Cloudflare said this could result in an unearned commission or divert credit from a legitimate partner, potentially damaging trust in the retailer's attribution system.

The other operations included an off-screen iframe with an auto-clicking hidden-link fallback, an older search-sabotage operation that tracked users and opened a backdoor for arbitrary remote JavaScript execution, and a campaign targeting mobile visitors that attempted to replace ads and analytics while disabling support or monitoring. The listed techniques included local storage opt-outs, remote code loading, host and viewport gates, UTM-tag conditions, IP substring matching, monitoring-tool disruption and zero-pixel tracking beacons.

Taken together, the cases show why Cloudflare is positioning Client-Side Security as continuous behavioral analysis rather than a lookup service. The company says understanding how JavaScript acts in the browser can reveal attacks that remain invisible to scanners relying on previously classified files, URLs or signatures.

Sources

• Cloudflare BlogWhen scanners miss the attack: how Cloudflare Client-Side Security protects storefronts