Full Report
Adform are an advertising company used by around 14k companies, owning around a 30% share of the demand-side category.They operate by offering a Javascript embed for websites, via this URL:hxxps://s2.adform.net/banners/scripts/st/trackpoint-async.jsThis script was compromised to serve a crypto stealer. Adform have been hacked. As far as I can tell Adform haven’t told people.This allows end user devices of downstream websites to be compromised with crypto stealing malware. Meaning if you visit example.com and they use Adform, example.com will compromise your device.An example of what is being served by s2.adform.net:File hash 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55That file flags as fine across vendors on Virustotal (all the URLs, files, domains and IPs flag as clean across all security vendors).The actual file served, trackpoint-async.js, had malicious code starting at this function:The code in this sample matches valid Bitcoin, Etherum and TRX wallets in clipboard:It then replaces said addresses in clipboard withThe wallet values are swapped for attacker controlled wallets. Addresses appear to vary.It does this by polling every 3 seconds, then swapping addresses in clipboard:Even if you notice the address is wrong and recopy the wallet, it keeps replacing it.Other scripts directly served by Adform include ones which poll out to the attacker:Aside from crypto fraud, they also record the IP address of the user, the website they arrived from (i.e. the supply chain bit of the compromise) and the URL path.The attacker server is 84.32.102.230 on port 7744An example request:hxxp://84.32.102.230:7744/p?h=example.com&u=/testIt appears Adform may be aware, or the attacker has realised they’ve been rumbled, as the malicious code appears to be disappearing as I type this out. I can see malicious activity via Adform over the past week, and the security industry appears to have entirely missed it.Example full script served by Adform for reverse engineers:https://pastebin.com/mc7psaNFIoCs84.32.102.230 — beacons2.adform.nethxxps://s2.adform.net/banners/scripts/st/trackpoint-async.jsAdform compromised to serve crypto stealer via supply chain attack was originally published in DoublePulsar on Medium, where people are continuing the conversation by highlighting and responding to this story.
Analysis Summary
# Incident Report: Adform Supply Chain Compromise and Crypto Stealer Injection
## Executive Summary
The advertising technology firm Adform suffered a supply chain compromise where a widely used JavaScript tracking script was modified to include a cryptocurrency "clipper" malware. This allowed attackers to hijack cryptocurrency transactions on end-user devices by replacing wallet addresses in the system clipboard. The incident impacted downstream websites using Adform’s services, potentially affecting thousands of organizations and their visitors.
## Incident Details
- **Discovery Date:** Approximately late October 2024 (based on report timing)
- **Incident Date:** Malicious activity observed over at least a one-week period prior to discovery.
- **Affected Organization:** Adform (and its downstream clients)
- **Sector:** Advertising Technology (AdTech) / Digital Marketing
- **Geography:** Global (Adform has a ~30% share of the demand-side category)
## Timeline of Events
### Initial Access
- **Date/Time:** Unknown exactly; activity documented for one week prior to the report.
- **Vector:** Supply Chain Compromise.
- **Details:** Attackers gained unauthorized access to Adform’s script hosting infrastructure to modify a legitimate, trusted file: `trackpoint-async.js`.
### Lateral Movement
- **Details:** Not specifically documented in the external analysis, but the breach involved moving from initial entry to the production environment responsible for serving static assets.
### Data Exfiltration/Impact
- **Details:** The malware captured user IP addresses, the referrer (originating) website, and the URL path. The primary impact was the financial theft of cryptocurrency by swapping wallet addresses in real-time.
### Detection & Response
- **How it was discovered:** Detected by security researcher Kevin Beaumont via analysis of script behavior and network traffic.
- **Response actions taken:** The malicious code began to be removed from the server (either by Adform or the attacker) shortly after the discovery became public or known to the entity.
## Attack Methodology
- **Initial Access:** Compromise of Adform’s web assets/content delivery mechanism.
- **Persistence:** Script-based; the script is loaded every time a user visits a site using Adform.
- **Defense Evasion:** The malicious script maintained a 0/70 detection rate on VirusTotal at the time of the incident, appearing benign to most security vendors.
- **Collection:** The script polled the user's system clipboard every 3 seconds looking for cryptographic address patterns.
- **Exfiltration:** Beacons sent telemetry (IP, URL, referrer) to an attacker-controlled server at `84.32.102[.]230`.
- **Impact:** Financial theft via "Clipper" functionality (replacing BTC, ETH, and TRX addresses with attacker-controlled addresses).
## Impact Assessment
- **Financial:** High potential loss for individual users performing crypto transactions.
- **Data Breach:** Exposure of user IP addresses and browsing habits (Referrer/URL) across 14,000+ companies.
- **Operational:** Integrity failure of Adform’s core delivery service.
- **Reputational:** Significant; the report indicates a lack of public disclosure by the company during the active phase of the compromise.
## Indicators of Compromise
- **Network Indicators:**
- `hxxp[://]84.32.102[.]230:7744` (Attacker C2/Beacon)
- `hxxps[://]s2.adform[.]net/banners/scripts/st/trackpoint-async.js` (Defaced script)
- **File Indicators:**
- SHA256: `02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55`
- **Behavioral Indicators:**
- Unauthorized modification of the system clipboard when visiting websites.
- Outbound traffic to port 7744 from high-reputation domains.
## Response Actions
- **Containment:** Removal of the malicious code from the `adform.net` CDN.
- **Eradication:** Identification of the compromised account or server used to push the update.
- **Recovery:** Restoration of the original, verified `trackpoint-async.js` file.
## Lessons Learned
- **Third-Party Risk:** Extensive reliance on third-party JavaScript creates a massive, often unmonitored, attack surface for organizations.
- **Evasion Tactics:** Attackers are successfully using "clean" reputations on VirusTotal to bypass automated defenses.
- **Transparency:** Delayed disclosure of supply chain attacks increases the window of opportunity for attackers to profit from the compromise.
## Recommendations
- **Subresource Integrity (SRI):** Downstream companies should implement SRI hashes for third-party scripts to ensure that modified files are not executed by the browser.
- **Content Security Policy (CSP):** Implement strict CSPs to restrict the domains to which scripts can send data (e.g., blocking unknown IPs like `84.32.102[.]230`).
- **File Integrity Monitoring (FIM):** Content providers must use FIM on their production CDN assets to detect unauthorized changes in real-time.