When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

This report details four active client-side JavaScript campaigns observed in the wild targeting e-commerce storefronts—(1) an after-hours affiliate-commission hijacker that intercepts product clicks and plants attacker attribution, (2) a clickless affiliate theft using off-screen iframes and hidden-link fallbacks, (3) a repurposed Lnkr backdoor enabling remote arbitrary JavaScript execution and telemetry, and (4) a paid-mobile cloaker that disables analytics/support for paid visitors; the paper covers their obfuscation and cloaking gates, provides sanitized code excerpts and IOCs, and argues for continuous browser visibility and ML-based detection.