Full Report
Online advertising firm Adform suffered a supply-chain attack that delivered cryptocurrency-stealing scripts to websites using its ad platform, replacing wallet addresses copied to visitors' clipboards with ones controlled by an attacker. [...]
Analysis Summary
# Incident Report: Adform Supply-Chain Script Compromise
## Executive Summary
Adform, a major European adtech firm, suffered a supply-chain attack where its JavaScript tracking script (`trackpoint-async.js`) was trojanized with malicious code. The compromise enabled a "clipper" attack that replaced cryptocurrency wallet addresses in users' clipboards with attacker-controlled addresses. The incident impacted website visitors globally across all platforms utilizing Adform’s tracking technology.
## Incident Details
- **Discovery Date:** July 27, 2026 (Confirmed by Adform); Publicly disclosed July 31, 2026.
- **Incident Date:** Ongoing for approximately one week prior to discovery (circa July 20–27, 2026).
- **Affected Organization:** Adform.
- **Sector:** Advertising Technology (Adtech).
- **Geography:** Global (Primary operations in Europe).
## Timeline of Events
### Initial Access
- **Date/Time:** Circa July 20, 2026.
- **Vector:** Supply-chain compromise.
- **Details:** Attackers gained unauthorized access to Adform’s infrastructure (specifically the delivery server `s2.adform[.]net`) to modify the legitimate `trackpoint-async.js` file.
### Lateral Movement
- **Details:** Not explicitly disclosed, but the attackers successfully pivoted from initial entry to the production environment responsible for serving client-side tracking scripts.
### Data Exfiltration/Impact
- **Details:** The malicious script exfiltrated visitor IP addresses, referring websites, and URL paths to a command-and-control (C2) server. The primary impact was the redirection of cryptocurrency payments by hijacking the clipboard.
### Detection & Response
- **How it was discovered:** Identified by security researcher Kevin Beaumont and confirmed by Adform’s internal monitoring on July 27.
- **Response actions taken:** Malicious code was stripped from the script; Adform initiated an investigation and notified affected clients.
## Attack Methodology
- **Initial Access:** Supply-chain compromise of the Adform ad-serving platform.
- **Persistence:** None on the endpoint; the script was non-persistent and only ran while the affected webpage was open in the browser.
- **Privilege Escalation:** Not applicable (Client-side execution).
- **Defense Evasion:** Use of obfuscation within the JavaScript file; the script was not flagged by antivirus engines (0/VT detection).
- **Credential Access:** Not applicable.
- **Discovery:** The script performed reconnaissance on the user's clipboard and webpage content for specific regex patterns.
- **Lateral Movement:** Distributed via legitimate supply-chain channels (Adform's CDN).
- **Collection:** Monitoring of the system clipboard for Bitcoin, Ethereum, and TRON wallet formats.
- **Exfiltration:** Sent telemetry (IP, Referrer) to 84.32.102[.]230[:]7744.
- **Impact:** Financial loss for users via fraudulent redirection of cryptocurrency transactions.
## Impact Assessment
- **Financial:** High potential for direct financial loss to end-users/investors; potential legal/fine liability for Adform.
- **Data Breach:** Exposure of user IP addresses and browsing habits (referring URLs).
- **Operational:** Minimal disruption to Adform services, as the core functionality remained intact while carrying the payload.
- **Reputational:** Significant damage to Adform’s reputation as a "trusted" third-party provider for major websites.
## Indicators of Compromise
- **Network Indicators:**
- 84.32.102[.]230:7744 (C2 and Telemetry)
- hxxp://s2.adform[.]net/banners/scripts/st/trackpoint-async.js (Compromised Source)
- **File Indicators:**
- `trackpoint-async.js` (Modified version containing obfuscated self-executing payload)
- **Behavioral Indicators:**
- Unauthorized modification of clipboard content when copying strings matching crypto-wallet regex patterns.
## Response Actions
- **Containment:** Removal of the malicious code from the hosted JavaScript library on July 27.
- **Eradication:** Cleansing of the delivery infrastructure to ensure no backdoors remained.
- **Recovery:** Notification sent to clients; recommendation for users to clear browser cookies to ensure any cached malicious scripts are purged.
## Lessons Learned
- **Supply Chain Vulnerability:** Third-party scripts are a massive blind spot; a compromise of one provider can impact millions of downstream users.
- **Detection Gap:** Standard antivirus and endpoint protection failed to detect the obfuscated JavaScript, highlighting the need for better script integrity monitoring (e.g., Subresource Integrity - SRI).
- **Transparency:** While Adform acted quickly to remove the code, the week-long dwell time allowed for significant potential theft.
## Recommendations
- **Subresource Integrity (SRI):** Website owners should implement SRI hashes for third-party scripts to prevent the execution of modified or hijacked code.
- **Content Security Policy (CSP):** Implement strict CSPs to restrict the domains scripts can communicate with, preventing unauthorized exfiltration to unknown C2 IPs.
- **File Integrity Monitoring (FIM):** Adform and similar providers must implement real-time FIM on their CDN and script repositories to alert on any unauthorized changes to production code.
- **Code Signing:** Ensure all delivered JavaScript assets are signed and verified before being served to clients.