Adform Ad Platform Compromised to Steal Cryptocurrency via Malicious JavaScript

Adform Script Compromised

Online advertising firm Adform, one of Europe’s largest adtech firms, suffered a supply-chain attack. Its JavaScript tracking script, 'trackpoint-async.js', served from 's2.adform.net', was compromised. This script is embedded in websites using Adform's advertising platform.

Cryptocurrency Theft Mechanism

The trojanized JavaScript continuously monitored the clipboard of users visiting websites that embedded the affected script. If it detected Bitcoin, Ethereum, or TRON wallet addresses, it replaced them with an attacker-controlled address. The code also rewrote addresses entered directly into form fields, not just those copied to the clipboard, and replaced addresses every three seconds.

Security researcher Kevin Beaumont discovered the malicious activity, explaining that this allowed end-user devices of downstream websites to be compromised with crypto-stealing malware.

Incident Response and Timeline

Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to authorities. The company stated the code was not designed to install software or establish persistence, operating only while an affected page remained open. While Adform's notice identifies July 27 as the affected date, Kevin Beaumont reported seeing malicious activity via Adform over the past week.

User Recommendations

Adform advises users to clear their browser cache, as the altered file may remain cached even after the fix. Additionally, users are recommended to check any wallet address before sending funds to ensure it is the intended recipient's address.