Attackers compromised a shared JavaScript file served by Adform, the Copenhagen-headquartered ad technology company and used it to silently replace cryptocurrency wallet addresses across every site that loaded the script. The malicious code polled visitors’ clipboards every 3 to 4 seconds and swapped any Bitcoin, Ethereum or TRON address it found for attacker-controlled wallets. The compromise was discovered on 27 July 2026.
The affected file was trackpoint-async.js, served from s2.adform.net. Because Adform delivers this script to multiple customer sites from a single shared endpoint, one compromise propagated silently to every downstream site loading it. Users copying a wallet address from one browser tab and pasting it into a transaction form in another had their funds redirected without any visible indication that anything had changed.
How the Clipboard Attack Works
The technique is a clipboard hijacker, a class of malware that has been common in standalone desktop malware for years but appears less frequently injected into third-party ad tracking scripts. The injected code ran a polling loop on a short interval, checking clipboard contents repeatedly rather than triggering on a single paste event. That approach makes it harder to catch with basic event listener monitoring because no standard browser clipboard event is ever fired.
Security researcher Kevin Beaumont who published a detailed write-up on Substack on 27 July, described the mechanism directly, “The wallet values are swapped for attacker controlled wallets.” Beaumont’s analysis, published on his DoublePulsar blog, identified the substitution logic targeting Bitcoin, Ethereum and TRON address formats. The code was capable of rewriting addresses whether they appeared in clipboard contents, form fields or direct user input.
This is not a complicated attack. There are no CVEs, no memory corruption bugs, no kernel exploits. A small block of obfuscated JavaScript inserted into a widely distributed tracking file was enough. The sophistication was in the delivery mechanism not the payload.
Adform Is Not a Minor Vendor
Adform is headquartered in Copenhagen and maintains offices across Europe including Stockholm. It operates one of the larger independent ad technology stacks in the European market, serving publishers and advertisers across the continent. A shared tracking script loaded by multiple customer sites is exactly the kind of high-value target that supply chain attackers pursue, compromise the script once, reach every downstream user automatically.
The attack is structurally identical to the 2018 British Airways Magecart incident and the 2019 Ticketmaster compromise both of which inserted malicious code into third-party scripts loaded at checkout. The difference here is that the payload targets cryptocurrency wallets specifically, which suggests the attackers were either monitoring which Adform customers handle crypto transactions, or were content to cast a wide net across the full customer base and collect whatever wallet traffic appeared.
Adform had not published a public incident statement at the time this article was written. That absence is a problem. Customer sites that loaded the compromised script during the exposure window need to know the timeline of the compromise to assess their own exposure and Adform has not yet provided it.
What Site Operators Need to Check Now
Any organisation loading trackpoint-async.js from s2.adform.net should treat the period before 27 July 2026 as potentially exposed. Review your Subresource Integrity implementation for all third-party scripts. If you were loading the Adform script without an integrity attribute, you had no mechanism to detect that the file had changed.
Subresource Integrity is the direct technical counter to this class of attack. It lets browsers verify a script’s cryptographic hash before executing it, which means a modified file will fail to load rather than run silently. It is not universally deployed and Adform’s own implementation guidance does not appear to mandate it. Organisations that handle any payment data including cryptocurrency addresses through pages that load third-party scripts should audit their SRI coverage this week.
A Content Security Policy that restricts which external domains can execute scripts on your pages limits the blast radius of this kind of compromise. It does not prevent a trusted vendor’s own file from being tampered with but it reduces exposure to lateral injection from compromised subdomains or CDN assets.
If your organisation processes cryptocurrency payments and uses Adform tracking on the same pages, review transaction logs from the past 30 days for any wallet addresses that do not match your own. The attacker-controlled wallets were substituted at the browser level so your server-side logs will show the correct destination address. The mismatch will appear in user-facing transaction records or customer support queries, not in your own payment infrastructure.
The Supply Chain Exposure Is Broader Than One Script
The Adform incident is a specific instance of a category of risk that the security industry has been documenting since at least 2015 and that organisations continue to underprice. The average enterprise web application loads dozens of third-party JavaScript files from external domains. Most of those files are loaded without integrity checks. Most of the vendors serving them do not publish change logs or notify customers when files are updated.
ENISA’s 2023 threat landscape report identified supply chain attacks as one of the primary threat vectors facing European organisations and the pattern has not changed since. What has changed is that attackers are now targeting ad tech infrastructure specifically because ad tracking scripts are present on a large number of high-traffic commercial sites and are almost never subjected to the same security review as first-party code.
The Adform compromise should prompt a direct conversation between security teams and marketing departments about which third-party scripts are currently loading on customer-facing pages who owns the vendor relationship and whether any of those vendors have been asked about their own code integrity controls. In most organisations, that conversation has not happened.
References
- Adform Compromised to Serve Crypto Stealer via Supply Chain Attack
- Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites
- ENISA Threat Landscape 2023
This post is also available in:
Svenska
