Cloudflare Detects 8 Malicious JS Operations Missed by Existing Scanners

Cloudflare's Page Shield ML successfully detected 8 malicious JS operations in live traffic that were missed by existing security scanners (VirusTotal failed to detect 7 out of 8, URLScan found no malicious verdicts). The detection mechanism involves a GNN (Graph Neural Network) classifying less than 0.3% of total traffic as suspicious, followed by secondary verification by LLM (Workers AI) and Teachers, a frontier model ensemble, via a restricted JavaScript evaluator.

Major Types of Detected Malicious Operations

1. Affiliate Commission Hijacking: Intercepts product tabs of mobile visitors and routes them through attacker affiliate links. It employs concealment techniques such as monitoring dynamic elements with MutationObserver, managing cooldowns using localStorage, and masking console output. Distribution occurred via marketing supply chains such as Google Tag Manager.
2. Clickless Affiliate Fraud: Sends affiliate requests without user clicks using hidden iframes or auto-clicked tags. While actual reward payouts were not observed, it utilized time-limited browsers and offscreen iframes, attempting tab navigation via fallback chains upon failure.
3. Lnkr Backdoor: Reused the Lnkr malware codebase as a backdoor for retail sites. It remotely downloads and executes arbitrary JS in customer browsers without modifying server files, and pauses scripts when keywords like 'virus' or 'popup' are searched to evade analysts.
4. Paid-mobile Cloaker: Targets only traffic from paid mobile ads to block store visibility. It activates only when specific UTM media and mobile screen conditions are met, excluding cloud, VPN, specific regions, and IPs to bypass scanners. It disables Google Ads and analytics tools, hijacking ads with alternative publisher IDs.

Defense Lessons and Implications

Attackers evade static snapshots of crawlers through selective execution conditions such as device, time, geography, and referrer. Therefore, behavior-first analysis, including in-browser event observation, state inspection, and network requests, is essential over signature-based analysis. Obfuscation techniques only increase analysis costs and cannot evade detection in the face of large-scale suspicious code identification and deep investigation based on frontier models like Page Shield ML. Connecting static analysis with dynamic context is necessary to grasp the overall role of malicious scripts.