Adform Ad Platform Hijacked in Cryptocurrency Theft Supply-Chain Attack

Online advertising firm Adform, one of Europe’s largest adtech companies, has disclosed a supply-chain compromise that turned its widely used tracking script into a vehicle for cryptocurrency theft. The attack, uncovered by security researcher Kevin Beaumont, injected malicious code into ‘trackpoint-async.js’—a core JavaScript file served from ‘s2.adform.net’ and embedded on every website that employs the Adform platform.

According to Beaumont’s analysis, the trojanized script continuously monitored the clipboard of any visitor loading a site with the compromised tracking library. When it detected a Bitcoin, Ethereum, or TRON wallet address, it silently replaced that string with an address controlled by the attacker. This meant that users copying a payment destination would inadvertently send funds to the attacker’s wallet. Beaumont explained: “This allows end-user devices of downstream websites to be compromised with crypto-stealing malware. Meaning if you visit example.com and they use Adform, example.com will compromise your device.”

The researcher also observed additional malicious scripts hosted on Adform infrastructure communicating with an external server at 84.32.102[.]230:7744, exfiltrating the victim’s IP address, referring website, and URL path. Despite the clear malicious intent, VirusTotal scans at the time showed that no antivirus engines flagged the file as harmful.

Adform confirmed that it detected suspicious activity on July 27 and subsequently “discovered a cybersecurity threat.” The company removed the injected code and stated it “took further measures to protect website visitors, our clients, and the Adform platform.” In a statement, Adform noted: “To our knowledge, the code was not designed to install software on a user’s device or establish persistence. It operated only while an affected webpage was open.” The firm recommended that anyone who visited a site embedding the affected Adform technology on 27 July 2026 clear their browser cookies to eliminate any residual code. Adform has also informed impacted clients directly with guidance.

BleepingComputer’s own examination of a sample preserved on the Internet Archive confirmed that the legitimate tracking library had been appended with an obfuscated self-executing payload. Beyond clipboard interception, the injected function also rewrote cryptocurrency addresses displayed on web pages, ensuring that any payment address shown to a visitor would be the attacker’s. Beaumont noted that the campaign had been active for approximately one week before discovery, with the oldest known sample dating to July 26. He shared a sample of the malicious script via Pastebin for further analysis by security engineers.

Adform asserts that its services are now safe to use, but its investigation continues. BleepingComputer has reached out to the company for additional comment on Beaumont’s findings. The incident underscores the risks posed by third-party script supply chains, where a single compromised dependency can expose visitors across thousands of websites to silent financial theft.