Adform Ad-Tech Platform Compromised: Supply-Chain Injection Serves Clipboard Crypto Stealer via trackpoint-async.js — Threadlinqs Intelligence
As of 2026-07-30, Adform Ad-Tech Platform Compromised: Supply-Chain Injection Serves Clipboard Crypto Stealer via trackpoint-async.js is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-1775 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Adform, a demand-side advertising platform with roughly 14,000 clients and ~30% DSP market share, had its widely embedded tracking script (s2.adform.net/banners/scripts/st/trackpoint-async.js)
On 2026-07-30, independent researcher Kevin Beaumont (DoublePulsar) disclosed that Adform's widely embedded third-party tracking asset, s2.adform.net/banners/scripts/st/trackpoint-async.js, had been modified to deliver a browser-based cryptocurrency clipboard clipper to every visitor of any of the roughly 14,000 downstream client sites embedding it. Adform holds an estimated 30% share of the demand-side platform (DSP) market, making this a high-reach, front-end software-supply-chain compromise: the trust relationship between a widely-syndicated ad-tech vendor and its client websites (and, transitively, those clients' visitors) was abused to distribute malware without any action required by the end user beyond loading a page that embeds the tag.
The injected payload polls the browser clipboard on a fixed interval (the disclosure describes ~3 seconds; code-level analysis of the extracted excerpt shows a 4-second `setInterval` loop — both are consistent with continuous, near-real-time polling), inspecting copied and typed text against three hardcoded regular expressions matching well-formed wallet address formats: Bitcoin (`\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,62}\b`), Ethereum (`\b0x[a-fA-F0-9]{40}\b`), and TRON/TRX (`\bT[1-9A-HJ-NP-Za-km-z]{33}\b`). When a match is found, the script silently substitutes the victim's copied or typed address with one of three attacker-controlled replacement addresses that are stored XOR-encoded in the payload (decode key `[0x4d,0x33,0x77,0x54,0x77,0x30]`) and only decoded at runtime — a lightweight but deliberate anti-static-analysis measure consistent with the payload's zero-detection VirusTotal status. The substitution logic re-asserts itself even if the victim re-copies the legitimate address, indicating a persistent polling/overwrite loop rather than a one-shot swap.
Code-level analysis of the payload (extracted and published via pastebin.com/mc7psaNF alongside the disclosure) shows the clipper goes well beyond a simple clipboard-read/write loop: it registers listeners for `input`, `copy`, `cut`, and `paste` events; walks the DOM with `document.createTreeWalker()` to scan text nodes and input/textarea elements for wallet-pattern matches as they are added; uses a `MutationObserver` to catch dynamically inserted content; and hijacks `HTMLInputElement.prototype.value` via `Object.defineProperty()` so that reads/writes to input fields are transparently intercepted and rewritten — meaning the substitution can occur even where the site's own JavaScript, not just the user's clipboard, sets the field value. Minified single-letter variable/function names (`_k`, `_d`, `_r`, `_w`, `_obs`, `_cp`, `_bn`, `_scanText`) and regex patterns stored as object properties rather than inline literals are additional lightweight obfuscation choices.
Independent of the financial theft function, the script also collects and exfiltrates the visitor's IP address (implicitly, via the HTTP connection to the beacon), HTTP referrer, and current URL path from any page that loads it — telemetry with no legitimate tracking justification and clear privacy/surveillance implications across the entire embedding client base. Exfiltration and address-replacement configuration are served from attacker infrastructure at 84.32.102.230 over TCP port 7744, using a simple HTTP beacon of the form http://84.32.102.230:7744/p?h={embedding_hostname}&u={url_path}. Infrastructure lookup attributes 84.32.102.230 to Cherry Servers (legal entity UAB Nacionalinis Telekomunikaciju Tinklas), ASN AS59642, a commercial VPS/hosting provider based in Amsterdam, Netherlands (reverse DNS ip-84-32-102-230.009.ptr.cherryservers.net) — a low-cost, rapidly-provisionable hosting choice typical of short-lived C2 collection endpoints rather than a mature, multi-layered C2 framework. A BeaconBeagle lookup against 84.32.102.230 returned no existing beacon/campaign correlation record at time of research, indicating this endpoint is not yet linked to previously catalog
Weaknesses (CWE)
CWE-829, CWE-1357, CWE-506
Target sectors: advertisingtechnology, mediaandpublishing, ecommerce, retail, financialservices, technology
Target regions: Global
Detections & IOCs
As of 2026-08-08, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1583, T1584, T1608, T1195, T1189, T1199, T1059, T1036, T1027, T1140
