Adform Tracking Script Compromised to Hijack Cryptocurrency Addresses
Summary
A trojanized Adform tracking script monitored visitors’ clipboards and replaced Bitcoin, Ethereum, and TRON addresses with attacker-controlled ones. Adform removed the code; its investigation continues.
Key points
- Researcher Kevin Beaumont found malicious code injected into Adform’s trackpoint-async.js tracking library, served from s2[.]adform[.]net.
- The script monitored clipboards on websites using Adform and replaced detected Bitcoin, Ethereum, or TRON wallet addresses with attacker-controlled addresses.
- The injected code could also rewrite wallet addresses displayed on webpages.
- Beaumont reported other Adform-hosted scripts communicating with an attacker-controlled server at 84.32.102[.]230:7744.
- BleepingComputer’s analysis of a sample confirmed an obfuscated payload appended to the tracking library.
- Adform said it removed the code and took protective measures; it said the code operated only while an affected webpage was open and was not designed to install software or establish persistence.
- Adform recommended that people who visited websites using the affected technology on July 27, 2026, clear browser cookies; the company said its investigation was ongoing.
Article Details
- Victim Organization
- Adform
- Victim Domain
- s2.adform.net
- Incident Type
- Supply-chain compromise of Adform's tracking JavaScript, which injected cryptocurrency wallet-address hijacking code.
- Incident Date
- 2026-07-26
- Disclosure Date
- 2026-07-27
- Data Types Exposed
- Victim IP addresses
- Referring website
- URL path
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- The compromised script monitored visitors' clipboards and replaced Bitcoin, Ethereum, and TRON wallet addresses with attacker-controlled addresses; it could also rewrite wallet addresses displayed on web pages. The script reportedly operated only while an affected webpage was open. No confirmed successful cryptocurrency theft was reported.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | s2[.]adform[.]net | Adform host from which the compromised tracking script was served. |
MITRE ATT&CK
T1115 · Clipboard DataThe malicious script monitored visitors' clipboards for cryptocurrency wallet addresses.T1195.002 · Compromise Software Supply ChainThe incident is described as a supply-chain attack involving compromised tracking JavaScript distributed through websites using Adform's platform.