Adform Adtech Script Compromised in Supply-Chain Crypto-Stealing Attack

Third-party advertising dependencies have once again proven to be a high-leverage vector for client-side supply-chain attacks, following a breach targeting European adtech provider Adform. Threat actors managed to modify Adform’s core tracking script, turning an analytics tool embedded across thousands of publisher websites into a silent cryptocurrency stealer.

Security researcher Kevin Beaumont discovered the compromised script, identifying that the malicious payload was injected into trackpoint-async.js—a JavaScript file hosted on Adform’s infrastructure at s2.adform.net. Because this tracking script is embedded directly into the front-end code of websites using Adform’s Demand-Side Platform (DSP) and Supply-Side Platform (SSP) services, the compromised code was automatically executed in the browsers of millions of unsuspecting web visitors.

How the Crypto Clipper Script Operates

The attack vector relied on a combination of clipboard hijacking (often referred to as a “clipper”) and dynamic DOM manipulation executed directly within the victim’s web browser context.

Once a user loaded a web page containing the trojanized trackpoint-async.js script, the JavaScript established event listeners to continuously monitor the browser’s clipboard. If the script detected that a user had copied a string matching the structural format of a Bitcoin, Ethereum, or TRON wallet address, it immediately overwritten the clipboard content with an attacker-controlled wallet address.

Beyond passive clipboard monitoring, the malware actively altered rendered web content. The script parsed the page’s Document Object Model (DOM) to locate displayed wallet addresses and replaced them with the attacker’s payment destinations. If a user attempted to copy a displayed wallet address directly from a web page or manually read it off the screen, the transaction would be routed to the threat actor rather than the intended recipient.

In addition to clipboard tampering, the script conducted light endpoint reconnaissance. It gathered contextual metadata from the host session—including the victim’s IP address, the HTTP referrer, and the exact URL path—and exfiltrated this information back to an attacker-controlled server at 84.32.102[.]230:7744.

Code analysis confirmed that the payload was appended in an obfuscated format to the end of the legitimate Adform tracking library. At the time of discovery, the trojanized file returned zero detections across all scanning engines on VirusTotal, illustrating how traditional signature-based antivirus solutions struggle to inspect dynamic, heavily obfuscated JavaScript executed inside the browser runtime.

Scope, Impact, and Blast Radius

The blast radius of an adtech supply-chain attack is inherently vast. Adform is one of the largest advertising technology operators in Europe, handling full-stack ad delivery, server management, and campaign tracking for major media outlets and commercial brands. When a provider of this scale suffers code tampering on an asset like s2.adform.net, every web domain loading that library instantly becomes a distributor of the malicious payload.

Historical web archive data from Archive.org confirmed the presence of the self-executing payload in snapshots taken as early as July 26. Evidence indicates the compromised script may have been active for up to a week prior to public disclosure.

Adform confirmed it identified suspicious activity on July 27 and moved quickly to eradicate the malicious code and secure its platform. Adform stated that the payload operated strictly in-memory during active browsing sessions and was not designed to install persistent malware binaries or disk-level backdoors on client endpoints. However, any user who visited an affected host site while the compromised script was active was vulnerable to fund redirection if they conducted a cryptocurrency transfer during that window.

The Threat of Unmonitored Client-Side Dependencies

This incident highlights a major architectural vulnerability in modern web development: implicit trust in dynamic third-party scripts. Web applications regularly load externally hosted JavaScript files directly into the user’s browser document root (<script src="https://s2.adform.net/..."></script>). Once loaded, these external scripts run with the exact same privileges as the site’s first-party code, gaining access to the DOM, local storage, cookies, and user input events.

While Subresource Integrity (SRI) hashes allow web developers to enforce cryptographic verification on external resources, SRI is rarely applied to analytics and adtech scripts because providers update these files frequently without notifying client engineers. As a result, e-commerce sites, news platforms, and enterprise portals unknowingly grant third-party vendors unmonitored write access to their users’ browser sessions. Attackers exploit this gap by targeting the upstream supply chain rather than attempting to breach thousands of individual downstream websites.

Remediation and Mitigation Guidance

Adform has purged the malicious code from trackpoint-async.js and confirmed that its platform services have been restored to a safe state. However, security teams and users should take specific steps to clear residual exposure:

• Site Administrators & Web Engineers: If your web properties load Adform tracking assets, purge edge caches (such as Cloudflare, Akamai, or Varnish) to guarantee that no cached instances of the compromised trackpoint-async.js script remain in distribution. Verify that your site loads the updated, clean upstream file served post-July 27.
• Network & SOC Defenders: Audit web proxy and DNS logs for outbound connections targeting the indicator of compromise 84.32.102[.]230:7744.
• End-User Action: Users who visited websites utilizing Adform services on or around July 27 should clear their browser cookies, site data, and browser cache to ensure local browser storage does not retain legacy script artifacts.
• Long-Term Prevention: Organizations should implement Content Security Policy (CSP) directives—specifically script-src and connect-src restrictions—and evaluate client-side script monitoring tools (such as DOM-integrity scanners) to flag unauthorized script mutations in real time. For web pages handling sensitive financial or cryptocurrency inputs, consider stripping non-essential third-party tracking scripts altogether.