AliExpress caught running heavily obfuscated scripts (collina.js & fireyejs.js) that hijack WebAudio API to generate zero-volume audio streams for hardware fingerprinting. The attack vector is elegant: continuously stream silent audio to probe hardware characteristics while simultaneously blocking Bluetooth multipoint switching (headphones stay locked to the browser tab). The scripts also harvest canvas fingerprints, WebGL renderer strings, screen dimensions, and network timing data to generate a persistent device ID that survives cookie deletion and private browsing. The obfuscation layer is non-trivial—variable names are mangled and control flow is flattened to evade static analysis. Only Brave's aggressive script blocking currently stops this. The technique exposes a gap in browser privacy models: WebAudio API access doesn't trigger permission prompts, and most fingerprinting countermeasures focus on canvas/WebGL while ignoring audio subsystem abuse. Worth auditing other major e-commerce platforms for similar patterns.