Cloudflare says its Page Shield ML system detected four malicious operations involving eight JavaScript payloads running on online storefronts. The campaigns hijacked affiliate commissions, intercepted shopper clicks, loaded remote code, altered analytics, or concealed activity from monitoring tools. Seven of the eight payloads were absent from VirusTotal, and URLScan issued no malicious verdict for any of them.
The system detected the scripts in live traffic by analyzing code structure and behavior, then used an LLM and human review to validate alerts. The campaigns used conditional execution based on factors such as device, time, browser state, referrer, host, and tracking parameters, allowing them to remain dormant during simple scans. Cloudflare’s findings show why continuous client-side visibility and behavioral analysis can expose attacks that reputation-based or one-time scanners miss.
https://blog.cloudflare.com/client-side-security-finds-4-malicious-campaigns/
oxhak / Ox HaK
npub1sx…dz7z7
2026-09-16 21:05:48 UTC
Author Public Key
npub1sxexewvzysc3affq4yzzh7w8e3udyujap2vlj7t6lkdg5dvhp24q4dz7z7Seen on
wss://relay.damus.ioPublished at
2026-09-16 21:05:48 UTCEvent JSON
{
"id": "75187a3dd5c9f24ca032688ff094be002fb597fc86c04f2a77e5614b78840c19",
"pubkey": "81b26cb98224311ea520a9042bf9c7cc78d2725d0a99f9797afd9a8a35970aaa",
"created_at": 1789592748,
"kind": 1,
"tags": [],
"content": "Cloudflare says its Page Shield ML system detected four malicious operations involving eight JavaScript payloads running on online storefronts. The campaigns hijacked affiliate commissions, intercepted shopper clicks, loaded remote code, altered analytics, or concealed activity from monitoring tools. Seven of the eight payloads were absent from VirusTotal, and URLScan issued no malicious verdict for any of them.\n\nThe system detected the scripts in live traffic by analyzing code structure and behavior, then used an LLM and human review to validate alerts. The campaigns used conditional execution based on factors such as device, time, browser state, referrer, host, and tracking parameters, allowing them to remain dormant during simple scans. Cloudflare’s findings show why continuous client-side visibility and behavioral analysis can expose attacks that reputation-based or one-time scanners miss.\n\nhttps://blog.cloudflare.com/client-side-security-finds-4-malicious-campaigns/",
"sig": "005a47866d9c2a501ff0bd02e1456691369c125da1b59cd1dee4fa0e34854f73325ced1b77653c678754cc850ce414825893773be5b970b73166f02d72d1116a"
}