How Cloudflare's ML Detects Hidden JavaScript Threats in E-Commerce
Machine learning exposes four stealthy attacks that bypass traditional security scanners
1The invisible threat to storefronts
Malicious JavaScript can operate undetected on e-commerce sites, siphoning affiliate revenue, hijacking user clicks, and tampering with analytics. These scripts often load alongside legitimate content, making them invisible to traditional security scanners. Cloudflare's Page Shield ML detected eight such payloads in live traffic that were missed by VirusTotal and URLScan. One payload remained undetected for over two years despite being indexed by URLScan.
2Why traditional scanners fail
Security tools relying on known signatures or URL blacklists miss novel attacks. Seven of the eight malicious payloads Cloudflare detected were absent from VirusTotal, while URLScan returned no malicious verdict. Attackers use techniques like conditional execution based on device type, location, or time to evade detection. Some scripts remain dormant unless specific conditions are met, making one-time scans ineffective against sophisticated threats.
3Graph neural network approach
Cloudflare's GNN analyzes JavaScript as a syntax tree rather than flat text, revealing relationships between code elements. This allows detection across minified, renamed, or lightly obfuscated scripts without relying on known signatures. The same GNN previously detected malicious npm packages and Magecart skimmers. It flags less than 0.3% of traffic as suspicious, which then undergoes LLM verification to reduce false positives.
4Four-tier verification system
Suspicious scripts receive multiple independent analyses: first by the GNN, then by a lightweight LLM. The most complex cases go to an ensemble of frontier models (called 'teachers') from six different model families. These models vote on four possible classifications (benign, skimming, malware, cryptomining), with human review only needed for unclear cases. Disagreements between models provide valuable signals rather than being treated as noise.
5Operation 1: Commission hijacking
This attack intercepts mobile product clicks on Sundays, opening an attacker-chosen product page while secretly routing through an affiliate link. It uses MutationObserver to detect dynamically loaded product buttons and implements a 3-day cooldown in localStorage to limit detection. The script was delivered through legitimate marketing tag managers, with the malicious domain (adtargett.com) typosquatting a real advertising domain (adtarget.com).
6Operation 1's business impact
The commission hijacker could divert affiliate payouts to unearned accounts, potentially damaging relationships with legitimate partners. Some paused variants showed the attackers strategically timed campaigns, with one explicitly noting it was paused after Black Friday. The attack leveraged the site's own marketing infrastructure for delivery, making detection harder during routine tag manager reviews.
7Operation 2: Clickless affiliate theft
This script sends affiliate requests without any user interaction, using hidden iframes or self-clicking links. It implements sophisticated cloaking: checking (but ignoring) geolocation data, then applying time-based rules using Asia/Kolkata timezone. The script writes 1-hour throttle cookies to avoid repetitive requests. If the iframe fails, it falls back to programmatically clicking a hidden link.
8Operation 2's technical evasion
The payload uses multiple concealment layers: it requires successful (but unused) geolocation API calls, implements odd/even hour rules, and embeds three TradeDoubler configurations (AU, US, UK). Property names are assembled character-by-character for obfuscation. The script fails closed if geolocation fails, potentially evading sandboxed analysis environments that block external requests.
9Operation 3: Repurposed search malware
Attackers adapted the Lnkr malware family (originally for search hijacking) into a storefront backdoor. While its search redirection capabilities remained dormant, the script sent telemetry to attackers and could download arbitrary new JavaScript. This shows how attackers repurpose old malware codebases for new targets, with dormant functionality that could be activated later.
10Operation 4: Analytics tampering
The fourth attack intercepted and modified analytics data, potentially skewing marketing decisions. Like the others, it used conditional execution based on browser state and implemented anti-analysis techniques. All four operations demonstrated how client-side threats evolve beyond simple skimmers to target various e-commerce revenue streams.
11The detection challenge
These attacks shared no universal signature or common concealment method. Some checked device type, country, time, or referrer before activating. Others used invisible iframes or intercepted dynamic elements. Traditional security tools that scan static page snapshots miss such context-dependent threats, requiring continuous browser visibility to detect.
12Why ongoing monitoring matters
Static scans can't catch scripts that activate only under specific conditions. Cloudflare's approach analyzes JavaScript behavior in real-time across execution contexts. The system continuously learns from new detections, with human-verified cases feeding back into GNN training. This creates a feedback loop that improves detection of nuanced threats while maintaining low false positive rates.