Traffic camouflage is a technique that makes malicious network activity look like ordinary web browsing. Instead of using obvious malware infrastructure, attackers try to blend command-and-control, payload retrieval, or data exfiltration into traffic patterns that resemble normal HTTPS requests, ad clicks, image loads, or other routine browser behavior.
This matters because many defenses start with reputation, destination category, or simple volume checks. If malicious sessions are hidden inside familiar-looking web activity, they can evade naive filtering and delay detection. In real attacks, camouflage may use legitimate services, low-trust websites, cached content, or domain names that do not immediately appear suspicious. Defenders counter it by correlating DNS logs, proxy logs, endpoint telemetry, and process ancestry, then looking for odd timing, repeated callbacks, unusual user-agent patterns, or script-driven requests. The key signal is often behavior, not the apparent topic of the site.