Full Report
Attackers modified a JavaScript file served by advertising technology company Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to authorities. Anyone who visited a site carrying the affected script on July 27 and copied a Bitcoin,
Analysis Summary
# Incident Report: Supply Chain Compromise of Adform Advertising Script
## Executive Summary
Adform, a global advertising technology company, suffered a supply-chain compromise where attackers injected malicious code into a widely distributed JavaScript library. The "clipper" malware targeted website visitors by programmatically replacing cryptocurrency wallet addresses (Bitcoin, Ethereum, Tron) in real-time. While Adform identified July 27, 2026, as the primary date of impact, external researchers suggest the window of exposure may have been longer.
## Incident Details
- **Discovery Date:** July 27, 2026
- **Incident Date:** July 27, 2026 (Confirmed by Adform); potentially one week prior (Per external researchers)
- **Affected Organization:** Adform
- **Sector:** Advertising Technology (AdTech)
- **Geography:** Global (180+ countries served)
## Timeline of Events
### Initial Access
- **Date/Time:** Specific breach timestamp unresolved; malicious activity noted throughout late July 2026.
- **Vector:** Supply Chain Compromise.
- **Details:** Attackers gained unauthorized access to Adform’s content delivery infrastructure to modify the legitimate tracking script `trackpoint-async.js` served from `s2.adform[.]net`.
### Lateral Movement
- **Details:** Information not publicly disclosed regarding internal movement; however, the attack successfully transitioned from Adform’s internal environment to thousands of downstream client websites via the shared JS resource.
### Data Exfiltration/Impact
- **Details:** The script intercepted "copy/paste" events and form field inputs. While Adform claims no IP addresses were stolen, the code contained functions to exfiltrate the victim's current hostname and URL path to a remote server.
### Detection & Response
- **How it was discovered:** Internal detection by Adform on July 27; corroborated by researcher Kevin Beaumont and a code sample published by Max Maass.
- **Response actions taken:** Malicious code removal, client notification, reporting to law enforcement, and public advisory for users to clear browser caches.
## Attack Methodology
- **Initial Access:** Compromise of Adform’s script deployment/hosting environment.
- **Persistence:** Browser-side only; the script ran as long as an affected webpage was open. No persistent software installation on the host OS.
- **Defense Evasion:** Use of 6-byte XOR obfuscation for replacement strings; zero detections on VirusTotal at the time of discovery.
- **Collection:** Hooked clipboard "copy" events and value setters on `input` and `textarea` elements.
- **Exfiltration:** Attempted HTTP requests to a hardcoded IP including victim metadata (hostname/path).
- **Impact:** Financial theft via "clipping" (replacing intended crypto-wallet addresses with attacker-controlled addresses).
## Impact Assessment
- **Financial:** Unknown; potential for significant diverted cryptocurrency funds.
- **Data Breach:** Exposure of browsing metadata (URLs/Hostnames) for an unknown number of visitors.
- **Operational:** Disruption to Adform’s ad-serving integrity and requirement for manual cache clearing by end-users.
- **Reputational:** High; exposure of Adform's 1,800+ customers to downstream security risks.
## Indicators of Compromise
- **Network Indicators:** `84.32.102[.]230:7744`, `s2.adform[.]net`
- **File Indicators:** `trackpoint-async.js` (Modified version)
- **Behavioral Indicators:** Automated modification of cryptocurrency addresses in text fields or clipboard immediately after copying.
## Response Actions
- **Containment:** Reverted the `trackpoint-async.js` file to a known-good version.
- **Eradication:** Removed the malicious blocks from the serving infrastructure.
- **Recovery:** Notified clients and provided guidance on remediation (cache clearing).
## Lessons Learned
- **Key Takeaways:** Shared third-party scripts remain a critical single point of failure for web security.
- **Gap:** There is a discrepancy between Adform's reported timeline and researcher observations, suggesting detection lag or a staggered rollout of malicious code.
## Recommendations
- **Subresource Integrity (SRI):** Implement SRI tags for third-party scripts to ensure browsers block modified or tampered files.
- **Content Security Policy (CSP):** Use strict CSP headers to restrict the domains to which scripts can send data (exfiltration prevention).
- **Supply Chain Auditing:** Increase monitoring and integrity checking of deployment pipelines for public-facing assets.