Cloudflare disclosed four malicious operations targeting online stores. They involved eight JavaScript scripts capable of manipulating store behavior in the visitor’s browser without making the site appear broken. The impacts included stealing affiliate commissions, intercepting clicks, falsifying analytics data, disabling monitoring and support tools, and opening a channel to load additional JavaScript from remote servers.
According to the company, the Page Shield Client-Side Security machine-learning model detected all eight payloads during live traffic. When the campaigns were later examined using public security tools, seven payloads did not appear in VirusTotal, while URLScan issued no malicious verdict for any of the cases. Cloudflare says that one version of the Lnkr family remained indexed in URLScan for roughly two and a half years without classification, including a direct scan in January 2024.
Attacks That Evade a Quick Snapshot
The four operations did not rely on a single signature or one obfuscation technique. Some scripts waited for a specific device, country, time, or browser state, while others monitored elements that appeared dynamically after the page loaded, performed referral requests inside an invisible frame, or loaded new instructions from an external server. These conditions make a single automated visit to the page insufficient to detect the behavior.
In the first operation, the payload intercepted mobile users’ clicks on products and opened a page specified by the attacker in a new tab, while routing the original tab through a referral link to attribute the purchase to an account that was not entitled to the commission. The active versions used idle periods of up to three days and monitored elements added to the page later.
The second operation stole affiliate commissions without requiring a click, through a hidden frame or a link clicked programmatically. Cloudflare could not prove that the requests actually resulted in sales attribution or commission payments, but it confirmed that the code executed hidden automated referral requests.
From Search Sabotage to a Backdoor
The third operation was a repurposed version of the Lnkr family, which had previously been associated with intercepting search results. Inside an online store, some of its older functions remained dormant, but the script sent visitor data and contained a mechanism for loading and executing arbitrary JavaScript from remote servers. Cloudflare did not determine what those servers actually executed in the second stage.
The fourth operation targeted mobile visitors arriving through paid campaigns. After passing a series of device, campaign, network, and geographic-location conditions, it attempted to remove or disable nine monitoring and analytics tools, hide the chat and contact form, and replace advertising and analytics identifiers with ones controlled by the attacker. The company confirmed the loading of an alternative analytics script and the sending of a tracking signal, but did not prove that session data was successfully stolen or revenue was redirected.
What Changes in Practice?
Cloudflare’s mechanism relies on a graph neural network model that analyzes JavaScript structure and the relationships between its components instead of searching for a known address or fingerprint. Scripts suspected by the system, representing less than 0.3% of the traffic analyzed, are passed to a small language model for a second opinion and to reduce false positives. The company then uses a set of advanced models to classify the code into categories including benign behavior, payment skimming, other malware, and cryptojacking, with human review of malicious or unresolved cases.
The key takeaway for e-commerce teams is that the marketing and third-party-tag supply chain has become part of the attack surface. However, the article does not establish that Google Tag Manager, AWS, or the marketing platforms whose domains were imitated were compromised; rather, it points to the use of lookalike domains to deceive quick reviews. Therefore, checking the page once or waiting for a known file to be classified is not enough: monitoring behavior across different states, devices, and times, along with analyzing dynamically loaded code, appear to be essential approaches for detecting this type of attack.