What happened: a trojanized Adform script injected into many sites
Adform, one of Europe's largest adtech firms and operator of a full-stack platform that includes Demand-Side Platform (DSP), Supply-Side Platform (SSP), ad servers and management tools, had its JavaScript tracking library trojanized and used to deliver cryptocurrency-stealing code to websites that embed the firm's assets.
Security researcher Kevin Beaumont identified the malicious activity in Adform's tracking script file named "trackpoint-async.js" served from "s2.adform.net." The injected code continuously monitored the clipboard of visitors to sites that used the Adform script and replaced detected wallet addresses with attacker-controlled addresses, redirecting cryptocurrency payments.
How the malicious code behaved
According to analysis cited by BleepingComputer, the added payload was appended in obfuscated form at the end of the legitimate Adform tracking library. The injected function performed at least two active behaviors: it replaced any string matching a crypto wallet address format on web pages, and it watched the clipboard for Bitcoin, Ethereum, and TRON wallet addresses and substituted an attacker-controlled address when a visitor copied one.
Beaumont also observed other malicious scripts hosted on Adform infrastructure communicating with an attacker-controlled server at 84.32.102[.]230:7744. Those scripts transmitted the victim's IP address, the referring website, and the URL path to the remote server.
Detection, scope and timeline
Beaumont reported that the activity was ongoing for about a week before discovery; the oldest archived sample BleepingComputer located was an Archive.org snapshot taken July 26, 2026 at 23:29:03 GMT. Beaumont shared a sample of the malicious script via Pastebin for security engineers to analyze.
Scanning the file via the VirusTotal platform showed it was not flagged as malicious by any of the available antivirus engines at the time of reporting, a detail Beaumont highlighted when describing the evasion of standard detection.
Adform's response and current status
Adform confirmed detection of "suspicious activity" on July 27 and said it discovered a "cybersecurity threat." The company stated it removed the malicious code and "took further measures to protect website visitors, our clients, and the Adform platform."
In its statement, Adform said: "To our knowledge, the code was not designed to install software on a user’s device or establish persistence. It operated only while an affected webpage was open." The firm says its services are now safe to use but that its investigation continues.
Adform also said it had informed affected clients "through dedicated communications and provided them with relevant information and recommended actions." The company recommended that individuals who visited websites embedding the "affected Adform technology on 27 July 2026" clear browser cookies to eliminate the malicious code.
What this means for technologists, affected clients, and end users
- Technologists and security teams: Monitor any instances of "trackpoint-async.js" served from "s2.adform.net" for appended, obfuscated payloads. Check outbound connections to 84.32.102[.]230:7744 and be aware that the injected code may not trigger antivirus detections according to VirusTotal results cited in reporting.
- Affected clients and site operators: If your site used Adform technology on or around July 27, 2026, review communications from Adform, follow the company's recommended actions, and validate that pages no longer serve the appended payload. Adform says it has informed clients directly.
- End users: The injected script could replace displayed or copied Bitcoin, Ethereum, and TRON addresses with attacker-controlled addresses. Adform recommends clearing browser cookies if you visited an affected site on July 27, 2026; Adform also says the code ran only while an affected page was open and was not designed to install persistent software.
What remains clear from the available record is that an advertising supply-chain vector was used to distribute a clipboard- and page-manipulating payload at scale, and that standard antivirus feeds did not flag the sample in VirusTotal. Adform removed the appended code soon after discovery and has communicated mitigation steps to clients, while the firm’s investigation continues.
Original reporting: BleepingComputer — Online ad firm Adform’s script compromised to steal cryptocurrency
