Hackers Hijack Adform Ad Script to Silently Swap Crypto Wallet Addresses on Thousands of Sites

A poisoned JavaScript file served by advertising technology giant Adform redirected cryptocurrency wallet addresses across an unknown number of customer websites on July 27, 2026 — potentially diverting digital funds from unsuspecting users worldwide.

Adform detected the malicious modification on July 27, removed the compromised code, notified affected clients, and reported the incident to authorities. The company serves roughly 1,800 customers and enables 1.5 billion ad displays daily across more than 180 countries — making the scale of potential exposure significant even if the active window was brief.

The attack exploited a foundational weakness in how advertising technology is deployed across the web. By compromising a single shared resource — the trackpoint-async.js file served from s2.adform[.]net — attackers gained simultaneous access to every downstream site running that script without breaching each one individually. This is the defining characteristic of a supply-chain attack and what makes it particularly dangerous. Understanding the broader implications of this kind of threat is essential for any business operating online — organisations unfamiliar with the attack surface their third-party scripts create should review the fundamentals of protecting websites from application-level security threats.

---

How the Malicious Script Worked

Security researcher Max Maass published a captured copy of the altered script on July 27. Analysis revealed two malicious blocks appended to the legitimate library, with replacement wallet strings obfuscated using a six-byte XOR key.

Clipboard Hijacking

The first block monitored clipboard activity. It watched for copy events and attempted to read the clipboard every four seconds — replacing any detected Bitcoin, Ethereum, or Tron wallet address with a hardcoded attacker-controlled address. It also fired an HTTP request to the external IP address 84.32.102[.]230:7744 on page load, transmitting the hostname and path of the page the visitor was on.

Real-Time Address Rewriting

The second block operated at the document level. It walked through text nodes, rewrote wallet addresses entered into input fields, textarea elements, and contenteditable sections, and restored cursor position after each rewrite to avoid detection. It intercepted copy, cut, paste, and input events — meaning even users who manually typed a wallet address rather than pasting one from a clipboard could have been affected.

Independent security researcher Kevin Beaumont disclosed the compromise publicly and flagged a critical detail about how persistent the script's interference was. "Even if you notice the address is wrong and recopy the wallet, it keeps replacing it," Beaumont wrote. He also reported that the compromised file and its associated URLs, domains, and IP addresses returned zero detections on VirusTotal at the time of discovery.

This combination of clipboard monitoring and real-time DOM manipulation made the attack unusually resilient. Standard user behaviour — noticing an error and re-pasting — provided no protection whatsoever. Users who rely on secure practices for managing a digital currency wallet should be aware that even cautious habits can be defeated when the compromise operates at the browser layer itself.

---

What Adform Has Confirmed — and What Remains Unknown

The Official Position

Adform stated the malicious code was not designed to install software or establish persistence on a user's device. It operated only while an affected page remained open in the browser. The company also said it found no evidence the code transmitted visitors' IP addresses or browsing data.

However, Adform's own incident notice acknowledged a significant caveat: "Technical analysis indicates that such transmission may have been possible." The first payload's HTTP request was structured to send page hostname and path data to an external server. Whether that data successfully reached the attacker's infrastructure has not been confirmed by the available sample analysis.

Critical Gaps in Disclosure

Several critical questions remain unanswered. Adform has not published the number of page loads that received the altered file. The company has not identified the attacker or explained how the threat actor gained access to its deployment path. No indicators of compromise have been included in Adform's public incident notice — a significant omission that limits the ability of security teams to assess their own exposure.

A timeline discrepancy also persists. Adform's official notice identifies July 27 as the affected date. Beaumont stated he observed malicious activity via Adform over the course of the past week — a gap that Adform has not publicly addressed and that prevents a reliable estimate of total user exposure.

The Broader Supply-Chain Risk

Supply-chain attacks on advertising infrastructure are not new — the 2020 SolarWinds compromise demonstrated how a single poisoned shared resource can cascade across thousands of organisations simultaneously. This incident follows that same architectural vulnerability, applied directly to the browser layer where financial transactions occur. For businesses operating e-commerce or transaction-based platforms, the risk is compounded by direct financial exposure; understanding how to protect an online business from cybersecurity threats has never been more operationally relevant.

---

What Users and Businesses Should Do Now

Immediate Steps for Users

Adform is advising anyone who visited a site carrying the affected script on July 27 to clear their browser cache immediately. The altered JavaScript file may remain cached locally even after Adform deployed its fix — meaning a user could still be served the malicious version from their own machine.

Before sending any cryptocurrency transaction, users should verify the destination wallet address character by character after pasting. Given that this script replaced addresses in real time and continued replacing them even after re-copying, a single visual confirmation is not sufficient. Cross-referencing the address in a separate application or on a different device adds a meaningful layer of protection.

What Businesses Running Third-Party Scripts Should Consider

For businesses running advertising technology or third-party JavaScript on customer-facing sites, this incident reinforces the risk of unconditional script deployment. Adform's own documentation notes that its tracking code can run across an entire website rather than on isolated pages — a design choice that maximised attacker reach once the shared file was compromised.

Security teams should consider the following measures in the wake of this incident:

• Audit all third-party JavaScript dependencies currently loading across your properties
• Implement Subresource Integrity (SRI) checks where possible to detect unauthorised modifications to external scripts
• Monitor outbound HTTP requests from browser sessions for unexpected external endpoints
• Establish an incident response process specifically for third-party script compromise scenarios

The Unresolved Scope of This Incident

The number of users who may have unknowingly sent cryptocurrency to an attacker-controlled address remains unknown. Adform has not published that figure and the full scope of the incident has not been established. Until the timeline discrepancy is resolved and complete exposure data is released, affected users and the businesses that carry Adform's script should treat the risk as ongoing.

This incident is a stark reminder that in an ecosystem built on shared infrastructure, the security of your users is only as strong as the least-secured script running on your pages.