Adform Supply-Chain Attack Poisons Script to Swap Crypto Wallet Addresses

Web Supply Chain Attack Targets Adform Tracking Script

Advertising technology vendor Adform has suffered a client-side supply-chain compromise after attackers injected malicious code into one of its core tracking scripts. The compromised resource, trackpoint-async.js hosted on s2.adform[.]net, was altered to act as a browser-side cryptocurrency “clipper”—silently hijacking wallet addresses copied or typed by users on any website carrying the script.

The Adform script poisoning attack allowed threat actors to execute arbitrary JavaScript in the context of thousands of downstream websites without breaching those sites individually. Adform detected the intrusion on July 27, 2026, removed the malicious payload, notified impacted clients, and reported the incident to law enforcement. However, because ad-tracking scripts are loaded unconditionally or across wide sections of customer sites, the blast radius of a single compromised JS library hosted on a central CDN is extraordinarily broad.

How the Malicious Script Operates

The attack vector leverages a classic web supply-chain injection technique reminiscent of Magecart-style digital skimming, adapted here for cryptocurrency theft. When loaded into a site visitor’s browser, the tampered trackpoint-async.js file appended two distinct malicious blocks to the end of Adform’s legitimate tracking library. Both blocks utilized strings obfuscated with a six-byte XOR key to evade naive static detection mechanisms.

The first malicious block targeted clipboard interactions and network telemetry:

• Clipboard Hijacking: It monitored for browser copy events and polled the user’s clipboard every four seconds, looking for strings matching standard wallet formats for Bitcoin (BTC), Ethereum (ETH), and Tron (TRX). When a match was identified, it replaced the target address with an attacker-controlled wallet.
• Exfiltration / Telemetry Attempt: Upon page load, this block attempted an HTTP request to 84.32.102[.]230:7744, passing along the hostname and URL path of the currently viewed page.

The second malicious block focused on active DOM manipulation within the page session:

• Form Field Interception: The script traversed the document’s text nodes to rewrite crypto wallet strings rendered inside <input>, <textarea>, and contenteditable elements, automatically restoring cursor positioning so the manipulation went unnoticed.
• Property Hooking: It hooked the JavaScript value setter on form controls, causing even programmatically injected or auto-filled wallet addresses to be rewritten in transit.
• Event Interception: It actively intercepted copy, cut, paste, and input events. Even if a user spotted a modified address and attempted to re-copy or re-type the original wallet, the script continually re-overwrote the value.

The code was ephemeral by design—it did not attempt disk persistence or secondary malware installation, operating strictly in browser memory while an infected page remained open.

Discrepancies in Scope and Observation Timeline

Security researcher Kevin Beaumont publicly disclosed details of the compromise, noting that he observed malicious activity originating from Adform’s infrastructure over the prior week, directly challenging Adform’s official notice limiting the impact window to July 27. Independent researcher Max Maass captured and published a sample of the poisoned script on July 27. At the time of initial disclosure, neither the modified JavaScript file, its C2 IP address, nor associated infrastructure flagged any detections on VirusTotal.

A major challenge in mitigating third-party JavaScript compromises is the tension between security controls and ad-tech functionality. Web developers rarely implement Subresource Integrity (SRI) hashes on ad-tracking scripts like trackpoint-async.js because ad networks dynamically update these files. Without SRI hashes or strict Content Security Policies (CSP) restricting clipboard access and outbound connections, third-party scripts execute with full permissions within the origin context of the host site.

While Adform reported serving 1.5 billion daily ads across 1,800 enterprise clients in over 180 countries during 2025, neither Adform nor researchers have confirmed the exact number of end-user page loads that received the poisoned script or the total financial losses resulting from diverted crypto transactions.

Indicators of Compromise & Mitigation Actions

Adform has remediated the server-side file on s2.adform[.]net, but endpoint and infrastructure risks remain for visitors who loaded the script while it was modified.

Technical Indicators

• Compromised URI: s2.adform[.]net/banners/scripts/trackpoint-async.js (or relative path variants)
• C2 / Telemetry Endpoint: 84.32.102[.]230:7744
• Targeted Cryptocurrencies: Bitcoin, Ethereum, Tron

Recommendations for Organizations and Users

• Clear Client-Side Caches: Adform strongly advises all users who visited affected sites on or around July 27 to clear their browser cache immediately, as HTTP caching mechanisms may cause local browser instances to serve the poisoned trackpoint-async.js file even after server-side removal.
• Outbound Traffic Blocking: Security operations teams should update network perimeter controls and endpoint protection policies to drop traffic bound for 84.32.102[.]230:7744.
• Verify Wallet Addresses: Anyone conducting cryptocurrency transactions on web platforms should visually confirm every character of destination addresses on hardware wallets or secondary out-of-band channels prior to signing transactions.
• Script Auditing & CSP Hardening: Site operators utilizing Adform or similar third-party ad frameworks should audit loaded scripts, evaluate the feasibility of restricting DOM modification permissions via Content Security Policy directives, and restrict unapproved outbound HTTP requests from client browser contexts.