In a recent security incident, attackers compromised a JavaScript file provided by Adform, a prominent advertising technology company, to manipulate cryptocurrency wallet addresses on client websites. This breach allowed the malicious code to alter wallet addresses copied by users, potentially redirecting funds to unauthorized accounts.
Adform identified the breach on July 27, 2026, promptly removed the malicious code, informed affected clients, and reported the incident to relevant authorities. Users who visited websites utilizing the compromised script on that date and copied Bitcoin, Ethereum, or Tron addresses may have inadvertently pasted altered addresses inserted by the malicious code.
To mitigate potential risks, Adform advises users to clear their browser cache, as the compromised file may remain cached even after the fix. Additionally, users should verify wallet addresses before initiating any cryptocurrency transactions to ensure accuracy.
The malicious code did not install software or establish persistent access; it operated solely while the affected webpage was open. Notably, the code could also modify addresses entered directly into form fields, indicating that clipboard copying was not the only method of address replacement.
Security researcher Kevin Beaumont observed malicious activity associated with Adform over the past week, suggesting a broader timeline of exposure. The compromised script, trackpoint-async.js, was served from s2.adform[.]net. According to Adform’s implementation documentation, this tracking code can run on individual pages, multiple sections, or across entire websites. This widespread deployment allowed attackers to infiltrate numerous downstream sites without breaching each one individually, classifying this as a supply-chain attack.
While an affected page was open, the altered address at the point of payment could redirect a cryptocurrency transfer. Beaumont noted that even if users noticed the incorrect address and attempted to recopy the wallet address, the malicious code would continue to replace it. At the time of his report, the compromised file and its associated URLs, domains, and IP addresses showed no detections on VirusTotal. Security researcher Max Maass published a captured copy of the script on July 27.
The captured sample contained two malicious code blocks appended to the legitimate library. These blocks were obfuscated using a six-byte XOR key. The first block monitored clipboard copy events, attempting to read the clipboard every four seconds and replace matching cryptocurrency addresses. It also attempted an HTTP request to 84.32.102[.]230:7744 upon page load, including the hostname and path of the visited page.
The second block traversed the document’s text nodes, modifying values in input, textarea, and contenteditable elements while preserving cursor position after each rewrite. It hooked into the value setter on input and textarea elements, ensuring that programmatic writes were also intercepted and altered. Additionally, it intercepted copy, cut, paste, and input events. Both blocks contained hardcoded replacement strings for Bitcoin, Ethereum, and Tron address patterns, with the addresses appearing to vary.
Adform stated that there was no evidence indicating that the malicious code transmitted visitors’ IP addresses or information about the websites they visited. However, technical analysis suggested that such transmission might have been possible. The first payload’s request was designed to send the page hostname and path to an external server; whether this data reached the attackers remains unconfirmed.
Several aspects of the incident remain unclear, including the number of websites that hosted the compromised file, the extent of visitor exposure, the method by which attackers accessed Adform’s deployment path, and whether any funds were successfully diverted. The discrepancy between Adform’s reported affected date and Beaumont’s observations further complicates the assessment of the exposure timeline.
This incident underscores the critical importance of securing third-party scripts and the potential risks associated with supply-chain attacks. Organizations must implement rigorous monitoring and validation processes for external code to prevent similar breaches. Users should remain vigilant, especially when handling sensitive information like cryptocurrency transactions, and verify all details before proceeding.
