Adform, a prominent advertising technology firm serving approximately 14,000 businesses and commanding nearly 30% of the demand-side platform market, has experienced a significant security breach. This incident transformed its trusted ad-serving infrastructure into a conduit for distributing cryptocurrency-stealing malware.
Security researcher Kevin Beaumont identified the compromise, revealing that attackers manipulated a widely utilized JavaScript file to covertly infect visitors across numerous client websites. The targeted file, a tracking script hosted on Adform’s domain, is embedded in countless sites to monitor advertising performance.
Due to the extensive reliance on this single script, compromising it allowed attackers to potentially reach millions of end users. Visitors to websites employing Adform’s tracking pixel could have unknowingly downloaded malicious code onto their devices, exemplifying a classic supply chain attack.
Once executed, the malicious script operates as a clipboard hijacker, a type of malware designed to steal cryptocurrency. It continuously monitors the victim’s clipboard, detecting copied Bitcoin, Ethereum, or Tron wallet addresses. Upon identifying a legitimate address, it replaces it with one controlled by the attacker.
Given the complexity of cryptocurrency addresses, most users paste them without verification, enabling funds intended for legitimate recipients to be redirected to the attacker’s wallet. Alarmingly, the malware persists even if the victim notices the discrepancy and recopies the address; it simply overwrites it again during the next monitoring cycle.
Beyond financial theft, the script also functions as a surveillance tool. It discreetly logs the victim’s IP address, the originating website, and the specific URL path visited, transmitting this data back to an attacker-controlled server. This data collection allows attackers to map their reach across affected sites.
What makes this incident particularly concerning is its ability to evade detection. All associated files, URLs, domains, and IP addresses returned clean results when checked against major antivirus and threat intelligence platforms. The malicious code was embedded within a script from a legitimate, trusted advertiser, allowing it to bypass standard security filters that typically flag suspicious third-party content.
As of this reporting, there is no public confirmation that Adform has notified affected customers or issued a formal disclosure. Observations suggest that the malicious code is being actively removed, indicating that either Adform or the attackers are aware that the operation has been exposed.
For website operators utilizing Adform’s services, immediate action is critical: audit third-party scripts, monitor outbound traffic to the identified attacker infrastructure, and rotate any exposed credentials.
Indicators of Compromise (IoCs):
- IP Address: 84.32.102[.]230 (Attacker-controlled beacon/C2 server on port 7744)
- Domain: s2.adform[.]net (Compromised Adform subdomain serving malicious script)
- URL: hxxps://s2[.]adform.net/banners/scripts/st/trackpoint-async.js (Malicious tracking script delivering clipboard hijacker)
- File Hash (SHA-256): 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55 (Malicious payload file, flagged clean on VirusTotal)
- Beacon URL Pattern: hxxp://84.32.102[.]230:7744/p?h=<domain>&u=<path> (Data exfiltration request pattern including victim domain and URL path)
This breach underscores the critical importance of securing supply chains in the digital advertising ecosystem. As attackers increasingly target trusted platforms to distribute malware, companies must implement rigorous security measures and maintain transparency to protect their clients and end users.
