What happens when malicious scripts use legitimate APIs and domains to hide their activity?

Bad actors often use legitimate services to mask their malicious activity. Making it harder to detect the malicious payloads. A popular approach is to use Google Tag Manager to inject malicious code. But popular CDNs also often use a host for malicious payloads. Since these requests appear to come from trusted, whitelisted sources, your code review tools will not flag them because they will not detect the underlying malicious intent. And the bad actor can make accounts on these platforms without sharing anything that could lead authorities back to them.