The Adform Breach: A Swapped Script Rewrote Crypto Wallets on Clients' Sites

Advertising technology company Adform has disclosed a compromise: attackers modified trackpoint-async.js, a JavaScript file it serves from the domain s2.adform[.]net, turning it into a tool that swapped cryptocurrency wallet addresses right in the visitor's browser. The company detected the incident on July 27, 2026, removed the malicious code, notified its clients, and contacted law enforcement.

How it worked

Anyone who opened a site with the infected script that day and copied a Bitcoin, Ethereum, or Tron address risked pasting an address planted by the malicious code instead. And the swap wasn't limited to the clipboard: the code also rewrote addresses typed manually into form fields. As independent researcher Kevin Beaumont noted, even if you spotted the wrong address and copied the wallet again, the script would replace it once more.

The captured sample contains two malicious blocks appended to the legitimate library; the strings used for the swap are encrypted with a six-byte XOR key. The first watches for the copy event, tries to read the clipboard every four seconds, and, when the page loads, sends an HTTP request to an external server carrying the host name and path of the open page. The second walks the document's text nodes, rewrites the values in input fields, and intercepts copy, paste, and input events. According to Beaumont, the substituted addresses appear to have changed.

A supply chain attack

The danger lies in the fact that Adform's tracking code can be embedded across an entire site at once. Compromising a single shared resource opened the attackers a path to a multitude of sites with no connection to one another — there was no need to break into each one individually. That is precisely what makes this case a classic supply chain attack.

The code didn't install software or persist on the system — it worked only while the infected page stayed open. Adform recommends clearing the browser cache, since the modified file may have been stored there, and checking the wallet address before any transfer of funds.

What remains unclear

The scope of the incident is not yet established: how many sites carried the infected file, how many visitors were affected, how the attackers gained access to Adform's deployment infrastructure, and whether any money was stolen. The timeline doesn't add up either: Adform cites July 27 as the affected date, whereas Beaumont observed the malicious activity over the course of a week. At the time of discovery, the file and its associated domains and IPs went undetected by antivirus engines on VirusTotal.

According to its 2025 annual report, Adform has around 1,800 clients, the platform delivers 1.5 billion ad impressions a day, and it operates in more than 180 countries — these figures describe the scale of the platform, not of the incident itself. How many page loads actually received the swapped resource, the company did not disclose.

Source: The Hacker News