Table of Contents
- One Compromised Script, Thousands of Sites
- How the Attack Worked
- The Clipboard Hijacker in Detail
- The Supply-Chain Problem
- What Adform Says
- What We Still Don't Know
- Who's Exposed
- Lessons for Developers and Security Teams
- The Bigger Picture
One Compromised Script, Thousands of Sites
On July 27, 2026, security researcher Kevin Beaumont flagged something unusual: Adform's widely-deployed JavaScript tracking file, trackpoint-async.js, had been quietly turned into a cryptocurrency wallet hijacker.
Adform is one of Europe's largest adtech companies. Its tracking script is embedded on thousands of websites globally. That single file, served from s2.adform.net, touches an estimated 1.5 billion ad impressions daily across more than 180 countries.
When attackers poisoned that one script, every site loading it became a vector. No breach of the downstream sites was needed. No code injection into individual websites. Just one compromised library, delivered from Adform's own infrastructure.
How the Attack Worked
The attack followed a classic supply-chain playbook:
-
Compromise the source: Attackers gained access to Adform's deployment pipeline and modified
trackpoint-async.js, appending malicious code blocks to the end of the legitimate library. -
Distribute via trust: Because the script is served from Adform's CDN (
s2.adform.net), browsers loaded it without triggering any security warnings. Every website using Adform's tracking technology automatically served the poisoned version to its visitors. -
Stay invisible: The malware was obfuscated using a six-byte XOR key, making it hard to detect through static analysis. At the time of Beaumont's discovery, the script had zero detections on VirusTotal.
-
Operate ephemerally: The malicious code ran only while an affected page remained open. It didn't install software or establish persistence, making forensic evidence harder to recover.
The Clipboard Hijacker in Detail
The captured sample contained two malicious blocks appended to the legitimate tracking library.
Block 1: Clipboard monitor
This block watches for copy events and polls the clipboard every four seconds. When it detects a string matching a Bitcoin, Ethereum, or Tron wallet address format, it replaces the clipboard content with an attacker-controlled address. Even if a user notices and re-copies the correct address, the script keeps overwriting it.
It also includes a hardcoded outbound request to 84.32.102[.]230:7744 on page load, sending the hostname and path of the page the visitor is on. Whether that data actually reaches the attacker's server hasn't been confirmed.
Block 2: DOM rewriter
This block walks the page's text nodes and rewrites wallet addresses found in input fields, textareas, and contenteditable elements. It hooks the value setter on input and textarea elements so even programmatic writes get rewritten in transit. It intercepts copy, cut, paste, and input events to catch every possible path to a wallet address.
Both blocks contain hardcoded replacement strings for Bitcoin, Ethereum, and Tron address patterns. Beaumont reported that the replacement addresses appeared to vary, suggesting the attacker may have rotated wallet targets.
The practical result: if you visited any site running Adform's tracking script during the compromise window, copied a crypto wallet address, and pasted it into a payment form, you may have sent funds to the attacker.
The Supply-Chain Problem
This incident is a textbook example of why supply-chain attacks on adtech infrastructure are so dangerous.
Adform's tracking script is not a peripheral widget. It's a core part of how websites measure traffic and serve ads. Companies embed it once, often years ago, and forget about it. But that single JavaScript file has full access to the page's DOM, the user's clipboard, and every input field on the page.
When a supply-chain attack targets a widely-deployed script like this, the blast radius is enormous. Adform's 2025 annual report lists roughly 1,800 direct customers, but the downstream exposure goes far beyond that number. Every one of those customers' end users is a potential victim.
The attack also demonstrates a persistent gap in web security: most browser-based security tools focus on known malicious domains and files. A freshly poisoned legitimate script, served from a trusted CDN, won't trigger most alert systems until someone manually identifies and reports it.
What Adform Says
Adform confirmed the incident in a public statement, saying it detected suspicious activity on July 27 and took immediate action:
- The malicious code was removed from the tracking script
- Affected clients were notified through dedicated communications
- The incident was reported to relevant authorities
- Services were restored and declared safe to use
The company stated: "To our knowledge, the code was not designed to install software on a user's device or establish persistence. It operated only while an affected webpage was open."
Adform recommended that affected users clear their browser cookies and cache to eliminate any cached version of the poisoned script, and to verify any wallet addresses before sending funds.
What We Still Don't Know
Several critical questions remain unanswered:
Duration: Adform says July 27 was the affected date. Beaumont says he observed malicious activity via Adform over the past week, suggesting the compromise may have started earlier. An Archive.org snapshot from July 26 already captured the malicious code.
Scope: How many websites loaded the poisoned script? How many visitors were exposed? How many cryptocurrency transactions were redirected? Adform hasn't published these numbers.
Entry point: How did the attackers compromise Adform's deployment pipeline? Was it an insider threat, a credential compromise, or something else?
Attacker identity: Adform has not publicly identified who carried out the attack.
Financial impact: Were any funds actually stolen? No confirmed cases have been reported publicly, but the absence of reports doesn't mean the absence of losses.
Who's Exposed
Anyone who visited a website running Adform's tracking technology during the compromise window and interacted with cryptocurrency wallet addresses is potentially affected. This includes:
- Users who copied and pasted Bitcoin, Ethereum, or Tron wallet addresses on affected pages
- Users who entered wallet addresses into form fields on affected pages
- Website operators using Adform's tracking script, whose visitors may have been compromised through no fault of their own
If you're unsure whether you were affected, Adform recommends checking the date of your last interaction with any site using their tracking technology and verifying the integrity of any cryptocurrency transactions made around that time.
Lessons for Developers and Security Teams
The Adform incident reinforces several principles that should guide how organizations approach third-party JavaScript:
Audit your dependencies regularly. Most organizations embed third-party scripts once and never revisit the decision. Schedule periodic reviews of every external JavaScript file your pages load. Know what each one does, what permissions it has, and whether it's still necessary.
Implement Subresource Integrity (SRI). SRI allows you to specify a cryptographic hash for external resources. If the file changes, the browser refuses to execute it. This is one of the most effective defenses against supply-chain attacks on CDN-hosted scripts.
Use Content Security Policy (CSP) headers. A strict CSP limits which scripts can execute on your pages. While it won't prevent attacks originating from your approved script sources, it reduces the overall attack surface.
Monitor for behavioral anomalies. The Adform malware made outbound HTTP requests to an unusual port (7744) and modified DOM elements at runtime. Network monitoring and runtime application self-protection (RASP) tools can flag this kind of behavior.
Minimize third-party JavaScript. Every third-party script you embed is a potential attack vector. Consider whether you truly need each one, and look for alternatives that require less privileged access.
The Bigger Picture
The Adform incident is not an isolated event. It's the latest in a growing series of supply-chain attacks targeting the adtech ecosystem. Previous incidents have involved malicious ads (malvertising), compromised ad networks, and trojanized analytics scripts.
What makes this attack particularly concerning is the scale of trust involved. Adform's infrastructure is trusted by browsers, by websites, and by the ad industry at large. Breaking that trust at the source means every downstream participant is exposed simultaneously.
For the security community, the incident is a reminder that browser-side threats don't always come from obviously malicious websites. Sometimes they come from the scripts that trusted websites load without a second thought.
For the crypto community, it's a warning that wallet security goes beyond private keys and exchange accounts. The clipboard and the browser are attack surfaces too, and they're only as secure as the code running on the pages you visit.