Cloudflare says its ML caught eight malicious JavaScript payloads that scanners missed

Four campaigns that scanners missed

Cloudflare says its Client-Side Security product, powered by the Page Shield machine-learning model, detected four malicious JavaScript operations — eight payloads in total — running in live traffic on storefronts. Detection was automated, with humans verifying each finding only afterwards.

According to the Cloudflare blog, seven of the eight payloads were entirely absent from VirusTotal, and URLScan returned no malicious verdict for any of them. Page Shield ML caught all eight in live traffic.

One case shows how long such scripts can sit unclassified. Although security researchers had documented the broader Lnkr family years earlier, one specific payload version stayed indexed by URLScan for nearly two and a half years with "No classification," including during a direct scan in January 2024. VirusTotal had ingested that payload and currently flags it as malicious, but Cloudflare notes the public record does not show when that verdict was first assigned. The company's argument: a file's hash can be known long before the code behind it is labeled malicious, and a defense that waits for the label is already late.

Models voting on suspicious scripts

The first stage of the pipeline is a graph neural network (GNN) that Cloudflare says previously caught malicious npm packages and an in-the-wild Magecart payment skimmer. Rather than treating JavaScript as flat text, it reasons over the code as a graph — a syntax tree connecting symbols, exposing what calls what, what the attacker buried and what still phones home. That structure lets it recognize suspicious patterns across minification, renaming and some obfuscation, without relying on a known URL or byte signature.

Fewer than 0.3% of analyzed scripts are flagged by the GNN, and those go to a lightweight large language model on Workers AI for a second opinion; when the LLM corroborates the GNN, customers are alerted. The most complex scripts go further, to a cohort of frontier models Cloudflare calls "teachers" — an ensemble of automated judges drawn from around six model families, including open-weight models on Workers AI. Each runs as an agent in its own fresh session, with a restricted JavaScript evaluator to unpack snippets and expose concealed behavior, and Cloudflare plans to extend the workflow soon with its Sandbox for isolated analysis.

The teachers sometimes disagree, especially on intricate scripts, and Cloudflare treats that disagreement as signal rather than noise. Each label becomes a vote weighted by the model's score on the Artificial Analysis Intelligence Index, producing a probability distribution over four labels: benign, payment skimming (magecart), other malware and cryptomining. Human reviewers examine only scripts flagged as malicious or lacking a two-thirds majority, and the label distributions feed back into GNN training, a loop that remains partly manual.

What the four operations did

The four campaigns shared no universal signature or concealment technique, which is precisely why one-off scanning struggles, Cloudflare argues.

The first hijacked affiliate commissions from mobile shoppers. It gated on device and local time, enforced a multi-day cooldown, and used a MutationObserver to watch for product tiles and buttons appearing after initial page load. When a visitor tapped a product, the script opened an attacker-chosen landing page in a new tab and routed the original tab through an affiliate link, stealing attribution and commission — including credit that would otherwise go to a legitimate referring partner.

The second stole affiliate commissions without any click at all, using an off-screen iframe, an auto-clicking hidden-link fallback, a spurious IP-lookup fetch, time gates and hourly rotation of affiliate tags.

The third repurposed an older search-interference script into a storefront backdoor, combining legacy keyword silencing, a localStorage opt-out and telemetry with remote code loading that permits arbitrary attacker-controlled JavaScript to execute.

The fourth, a "paid-mobile cloaker," targeted campaign-tagged mobile visitors. It gated on host, viewport and UTM tags plus a 325-entry IP substring list, disables nine monitoring and analytics tools, attempts to replace ads and analytics, hides support and fires zero-pixel tracking beacons — blinding the store to the very visitors it paid to acquire.

One operation stayed dormant unless device, country, time, referrer or browser state matched what it was waiting for, so a crawler that loaded the page once would likely have seen nothing. Continuous visibility inside the browser, Cloudflare argues, is what separates catching these attacks from missing them entirely.

Why it matters

Client-side JavaScript runs with a site's implicit trust, and storefronts typically load large amounts of third-party code. These attacks do not break checkout — they siphon affiliate revenue, distort analytics and open execution backdoors while everything looks healthy, which is how they persist for years. Cloudflare's numbers quantify the coverage gap of signature- and hash-based scanners here: seven of eight payloads missing from VirusTotal, zero malicious verdicts from URLScan, one payload unclassified for two and a half years.

One caveat: the findings come from Cloudflare's own telemetry and were published to demonstrate the product the company sells, so they have not been independently verified. But the pattern they describe — dormant, condition-gated scripts engineered to look benign to automated visitors — is a real exposure for any site that leans on third-party scripts, and it is the core argument for behavior-based detection in the browser.