Cloudflare's AI Catches 8 Storefront Attacks Scanners Missed
Seven of the eight payloads were absent from VirusTotal and none were flagged by URLScan, yet Cloudflare's tool caught all eight live.
- Cloudflare published "When Scanners Miss The Attack" on September 16, 2026, detailing four malicious JavaScript campaigns found by its Graph Neural Network (GNN).
- "Page Shield ML, meanwhile, caught all eight in live traffic."
- One campaign hid behind 325 IP addresses to dodge ad reviewers and support staff.
Why it matters: A blocklist only recognizes crimes already catalogued; the newest theft is always the one invisible to it.