DEVOURED
When Scanners Miss the Attack: How Cloudflare Client-Side Security Protects Storefronts
Cloudflare's Page Shield system used machine learning to detect four malicious JavaScript campaigns that bypassed standard scanners like VirusTotal.
What: Cloudflare caught eight payloads involved in affiliate commission theft, ad fraud, and remote code execution by analyzing JavaScript behavior rather than signatures. The malicious scripts used complex cloaking techniques, including IP denylists and browser-state checks, to remain dormant for most visitors.
Why it matters: This incident demonstrates that attackers have moved beyond simple obfuscation to sophisticated 'cloaking' techniques that intentionally evade static analysis and automated security crawlers.
Takeaway: Enable continuous script monitoring in your Cloudflare dashboard to gain visibility into third-party JavaScript execution patterns on your storefront.
Deep dive
- Used a graph neural network (GNN) to map code symbols and connections rather than flat text signatures.
- Leveraged Workers AI for a second opinion on scripts flagged by the primary model.
- One campaign targeted high-value paid mobile traffic while remaining invisible to desktop users and security scanners.
- Techniques included 'typosquatting' domain names to mimic trusted marketing vendors.
- Payloads used CSS injection to hide support chat interfaces and legitimate analytics tools while injecting rogue trackers.
Decoder
- Cloaking: A technique used by attackers to hide malicious activity from security scanners by checking if the visitor matches specific criteria, such as a known analyst IP address or bot signature.
- Typosquatting: Registering a domain name very similar to a legitimate service to deceive users or bypass security filters.
Original article
Full article content is not available for inline reading.
Explore all 67 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi