CLOUDFLARE says its Page Shield machine-learning system detected four malicious JavaScript operations, comprising eight payloads, in live traffic on online retail and tourism sites. Humans verified the findings after automated detection; seven of the eight payloads were absent from VirusTotal and none received a malicious verdict from URLScan.
The campaigns targeted different forms of abuse, including affiliate-commission theft, search and click manipulation, visitor tracking and remote code execution, and the disabling or replacement of analytics, advertising and customer-support tools.
One campaign intercepted qualifying mobile shoppers’ product clicks, opened an attacker-selected page and routed the original tab through an affiliate link, potentially diverting commissions. Another used time and browser-state checks to load an affiliate URL in an invisible iframe without requiring a click; Cloudflare confirmed the covert requests but could not establish whether they generated paid commissions.
A repurposed Lnkr-family script, embedded directly in a retailer’s HTML, included analyst-evasion features and could fetch and execute arbitrary JavaScript from remote servers, although the researchers could not determine what second-stage code was used. The fourth campaign cloaked itself from most visitors, activating mainly for US mobile users arriving through specified campaign tags.
It removed nine monitoring or analytics tools, hid support controls and loaded replacement advertising and analytics identities; dynamic testing confirmed a replacement tracking beacon, but not successful data theft or advertising diversion.
Cloudflare attributes the campaigns’ concealment to extensive gates based on device, time, geography, referrer, session state and IP data, as well as lookalike delivery domains including `adtargett[.]com` and `sdk-amazonaws[.]com`. Its detection uses graph analysis of JavaScript behaviour, followed by large-language-model review and, for complex cases, human verification. The company advises continuous monitoring of client-side scripts and has published indicators of compromise for investigation.