Online advertising firm Adform suffered a supply-chain attack that delivered cryptocurrency-stealing scripts to websites using its ad platform, replacing wallet addresses copied to visitors’ clipboards with ones controlled by an attacker.
Adform is one of Europe’s largest adtech firms, providing a full-stack platform that includes Demand-Side Platform (DSP), Supply-Side Platform (SSP), ad servers, and management tools.
Security researcher Kevin Beaumont discovered the malicious activity, saying that it stemmed from ‘trackpoint-async.js,’ Adform’s JavaScript tracking script served from ‘s2.adform.net’ and embedded in every website using the advertising platform.
According to the researcher, the trojanized JavaScript continuously monitors the clipboard of users visiting websites that embed trackpoint-async.js.
If the script detected Bitcoin, Ethereum, or TRON wallet addresses, it replaced them with an attacker-controlled address to redirect cryptocurrency payments.
source: BleepingComputer
“This allows end-user devices of downstream websites to be compromised with crypto-stealing malware. Meaning if you visit example.com and they use Adform, example.com will compromise your device,” Beaumont explains.
The researcher also observed other malicious Adform-hosted scripts communicating with an attacker-controlled server at 84.32.102[.]230:7744, sending the victim’s IP address, referring website, and URL path.
Running the script through the VirusTotal scanning platform shows that it is not flagged as malicious by any of the available antivirus engines.
Source: doublepulsar.com
Current status
Beaumont notes that the malicious code was removed from Adform’s tracking script soon after his discovery.
Adform confirmed its detected suspicious activity on July 27 and discovered a “cybersecurity threat.” The company said that it removed the malicious code and “took further measures to protect website visitors, our clients, and the Adform platform.”
“To our knowledge, the code was not designed to install software on a user’s device or establish persistence. It operated only while an affected webpage was open,” Adform says.
The company states that its services are now safe to use but its investigation continues.
Individuals who visited websites that embedded the “affected Adform technology on 27 July 2026” are impacted and the recommendation is to clear browser cookies to eliminate the malicious code.
“Adform has informed affected clients through dedicated communications and provided them with relevant information and recommended actions.”
Beaumont has shared a sample of the malicious script via Pastebin for security engineers to analyze.
BleepingComputer’s analysis of a sample stored on Archive.org also confirmed that a self-executing payload had been injected into the Adform tracking library served from the company’s infrastructure.
The malicious code was appended in obfuscated form at the end of the legitimate library and included a function that replaced any string matching a crypto wallet address format.
Apart from hijacking clipboard content, the malware can also rewrite wallet addresses on web pages. This way, if a payment address is displayed, it would be the attacker’s.
Beaumont says the malicious activity delivered through Adform has been ongoing for the past week without being detected. The oldest sample BleepingComputer could find was from from the Archive.org snapshot on July 26, taken at 23:29:03 GMT.
BleepingComputer has contacted Adform to request a statement regarding Beaumont’s findings and will update the story if we receive a response.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
