Cloudflare disclosed four waves of malicious JavaScript that evade detection with conditional triggers and target affiliate attribution manipulation.
Cloudflare recently disclosed four waves of malicious JavaScript attack activity, involving a total of eight malicious payloads, with targets concentrated in website front-end execution environments.[1]
Among these payloads, seven did not appear in VirusTotal, and URLScan did not classify any of the eight payloads as malicious.[1]
These malicious JavaScript files use different activation conditions across attack campaigns, such as device, time, region, browser state, or network environment, and only execute malicious functions when the conditions are met.[1]
The first technique is conditional activation, in which attackers first use environmental conditions such as device, region, time, or network type as a threshold, allowing only visitors who meet the conditions to enter the malicious flow.[1]
One of the attack waves avoids enterprise networks or VPN connections and removes scripts related to website monitoring and analytics tools such as New Relic, Hotjar, and Microsoft Clarity.[1]
The second technique is related to existing code from the Lnkr malware family. Cloudflare stated that attackers implanted a backdoor on an online retailer’s website and could download and execute new JavaScript from attacker-controlled servers.[1]
The third and fourth attack types focus on affiliate attribution manipulation. One wave does not require a user to actually click an ad and can automatically send affiliate requests in the background through a hidden iframe.[1]
This type of mechanism typically tracks transactions after a user reaches a merchant site through a specific promotional link and calculates commissions based on the attribution result.[1]
Attackers attempt to manipulate affiliate attribution results so that subsequent user transactions may be credited to a specific affiliate account.[1]
Because malicious functions do not activate for all visitors, scans may fail to detect the actual malicious behavior if the attack conditions are not triggered.[1]
Cloudflare’s observations also show that traditional scanning tools may not reveal malicious behavior if the conditions are not triggered.[1]
For website operators, pay attention to whether code is activated only in specific network environments, on specific devices, or in specific regions.[1]
For affiliate marketing workflows, especially watch for requests automatically sent in the background through hidden iframes.[1]
For front-end monitoring components such as New Relic, Hotjar, and Microsoft Clarity, verify whether their related scripts have been removed.[1]