Adform Ad-Tech Platform Compromised: Supply-Chain Injection Serves Clipboard Crypto Stealer via trackpoint-async.js

Key facts

Detection coverage

As of 2026-07-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1775 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Compromised Adform trackpoint-async.js — SHA256/URL Match in Web Proxy Logs

Detects direct retrieval of the confirmed-malicious Adform tracking script by exact SHA256 hash or compromised URL path, indicating a client browser loaded the trackpoint-async.js supply-chain payload behind TL-2026-1775.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1199, T1036
• Data sources: web_proxy, stream:http, squid, zscaler
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy sourcetype="stream:http" (url="*s2.adform.net/banners/scripts/st/trackpoint-async.js*" OR file_hash="02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55")
| eval match_reason=if(match(url, "trackpoint-async\.js"), "compromised_url_match", "sha256_hash_match")
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(src_ip) as src_ips by url, file_hash, match_reason
| where count > 0
| sort -last_seen

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has "s2.adform.net/banners/scripts/st/trackpoint-async.js" or FileHash =~ "02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55"
| extend MatchReason = iff(RequestURL has "trackpoint-async.js", "compromised_url_match", "sha256_hash_match")
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, FileHash, MatchReason, DeviceVendor
| order by TimeGenerated desc

Sigma

title: Compromised Adform trackpoint-async.js Script Retrieved (Hash or URL Match)
id: e4a1c2d3-1775-4b8a-9f01-aa1775000001
status: experimental
description: Detects retrieval of the confirmed-malicious Adform trackpoint-async.js supply-chain payload by exact SHA256 hash or compromised URL path (TL-2026-1775).
references:
    - https://doublepulsar.com/adform-compromised-to-serve-crypto-stealer-via-supply-chain-attack-2f1ec024f33e
    - https://pastebin.com/mc7psaNF
author: Threadlinqs Team
date: 2026/07/30
tags:
    - attack.initial_access
    - attack.t1195.002
    - attack.t1199
    - attack.t1036
logsource:
    category: proxy
    product: network
detection:
    selection_url:
        c-uri|contains: 's2.adform.net/banners/scripts/st/trackpoint-async.js'
    selection_hash:
        FileHash: '02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55'
    condition: selection_url or selection_hash
fields:
    - src_ip
    - dst_ip
    - c-uri
    - FileHash
falsepositives:
    - None expected while the compromise is unremediated; re-verify hash against vendor confirmation before treating future matches as benign
level: critical

Known false positives:

• Legitimate access to a remediated/clean version of trackpoint-async.js after Adform rotates the file hash — verify hash currency before alerting

Tuning notes: Update the SHA256 IOC immediately once Adform confirms remediation and publishes a new clean-file hash, otherwise this detection will false-positive on the legitimate patched script; until then treat any hit as confirmed compromise.

• 🔒 Ad-Tech Script Integrity Drift — Unexpected Hash Change on Trusted [indicator] Domain · unlock with TL Creds
• 🔒 Repeated Clipboard/Input Wallet-Address Overwrite Pattern (Post-Copy Reassertion Loop) via Endpoint DLP Telemetry · unlock with TL Creds
• 🔒 OSINT-Corroborated Sibling Infrastructure Sweep — Community-Observed Magecart-Cluster Domains Alongside Confirmed C2 · unlock with TL Creds
• 🔒 Masquerading Trusted Ad-Tech Domain Serving Compromised [indicator] (Trusted-Relationship Abuse) · unlock with TL Creds
• 🔒 Object.defineProperty Input-Value Hijack + MutationObserver/TreeWalker DOM-Scan Signature in Page Script · unlock with TL Creds
• 🔒 Full Kill-Chain Correlation — Compromised Adform Script Load Followed by Non-Standard-Port Exfil Beacon · unlock with TL Creds
• 🔒 Wallet-Address Regex & XOR Decode-Key Byte Sequence in Third-Party Script Content · unlock with TL Creds
• 🔒 Non-Standard-Port C2 Beacon to [indicator]:7744 / Cherry Servers CIDR (h=/u= Beacon Shape) · unlock with TL Creds

Indicators of compromise

As of 2026-07-30, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-1775.

Sample indicators (3 of 25)

• IP address: 84.32.102[.]230
• URL: hxxps://pastebin[.]com/mc7psaNF
• File hash: 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

Technical analysis

The payload returns clean across all VirusTotal engines, no CVE/vendor advisory exists, and the malicious code was observed disappearing mid-investigation with no confirmed remediation.

On 2026-07-30, independent researcher Kevin Beaumont (DoublePulsar) disclosed that Adform's widely embedded third-party tracking asset, s2.adform.net/banners/scripts/st/trackpoint-async.js, had been modified to deliver a browser-based cryptocurrency clipboard clipper to every visitor of any of the roughly 14,000 downstream client sites embedding it. Adform holds an estimated 30% share of the demand-side platform (DSP) market, making this a high-reach, front-end software-supply-chain compromise: the trust relationship between a widely-syndicated ad-tech vendor and its client websites (and, transitively, those clients' visitors) was abused to distribute malware without any action required by the end user beyond loading a page that embeds the tag.

The injected payload polls the browser clipboard on a fixed interval (the disclosure describes ~3 seconds; code-level analysis of the extracted excerpt shows a 4-second `setInterval` loop — both are consistent with continuous, near-real-time polling), inspecting copied and typed text against three hardcoded regular expressions matching well-formed wallet address formats: Bitcoin (`\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,62}\b`), Ethereum (`\b0x[a-fA-F0-9]{40}\b`), and TRON/TRX (`\bT[1-9A-HJ-NP-Za-km-z]{33}\b`). When a match is found, the script silently substitutes the victim's copied or typed address with one of three attacker-controlled replacement addresses that are stored XOR-encoded in the payload (decode key `[0x4d,0x33,0x77,0x54,0x77,0x30]`) and only decoded at runtime — a lightweight but deliberate anti-static-analysis measure consistent with the payload's zero-detection VirusTotal status. The substitution logic re-asserts itself even if the victim re-copies the legitimate address, indicating a persistent polling/overwrite loop rather than a one-shot swap.

Code-level analysis of the payload (extracted and published via pastebin.com/mc7psaNF alongside the disclosure) shows the clipper goes well beyond a simple clipboard-read/write loop: it registers listeners for `input`, `copy`, `cut`, and `paste` events; walks the DOM with `document.createTreeWalker()` to scan text nodes and input/textarea elements for wallet-pattern matches as they are added; uses a `MutationObserver` to catch dynamically inserted content; and hijacks `HTMLInputElement.prototype.value` via `Object.defineProperty()` so that reads/writes to input fields are transparently intercepted and rewritten — meaning the substitution can occur even where the site's own JavaScript, not just the user's clipboard, sets the field value. Minified single-letter variable/function names (`_k`, `_d`, `_r`, `_w`, `_obs`, `_cp`, `_bn`, `_scanText`) and regex patterns stored as object properties rather than inline literals are additional lightweight obfuscation choices.

Independent of the financial theft function, the script also collects and exfiltrates the visitor's IP address (implicitly, via the HTTP connection to the beacon), HTTP referrer, and current URL path from any page that loads it — telemetry with no legitimate tracking justification and clear privacy/surveillance implications across the entire embedding client base. Exfiltration and address-replacement configuration are served from attacker infrastructure at 84.32.102.230 over TCP port 7744, using a simple HTTP beacon of the form http://84.32.102.230:7744/p?h={embedding_hostname}&u={url_path}. Infrastructure lookup attributes 84.32.102.230 to Cherry Servers (legal entity UAB Nacionalinis Telekomunikaciju Tinklas), ASN AS59642, a commercial VPS/hosting provider based in Amsterdam, Netherlands (reverse DNS ip-84-32-102-230.009.ptr.cherryservers.net) — a low-cost, rapidly-provisionable hosting choice typical of short-lived C2 collection endpoints rather than a mature, multi-layered C2 framework. A BeaconBeagle lookup against 84.32.102.230 returned no existing beacon/campaign correlation record at time of research, indicating this endpoint is not yet linked to previously catalogued C2 infrastructure or malware families in that dataset.

The compromised script file itself carries SHA256 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55 and, as of publication, returns a clean (zero-detection) verdict across all VirusTotal vendor engines despite confirmed malicious clipboard-hijacking behavior — a meaningful detection gap for any defender relying on AV/reputation scoring alone rather than behavioral, network, or content-inspection-based indicators (e.g., matching the wallet-detection regexes or the XOR decode key against script content).

As of publication there is no CVE assignment, no CVSS score, and no public vendor advisory or remediation confirmation from Adform. The disclosing researcher noted that the malicious code appeared to be disappearing from the live script mid-investigation, which could indicate either quiet vendor-side remediation or the attacker pulling the implant upon discovery — neither has been confirmed. No attribution to a known threat actor or malware family has been established; the clipper itself has not been named or linked to a previously catalogued crypto-clipper family (e.g., Laplas, CountLoader-delivered clippers) by the source, and no follow-up vendor statement, additional researcher corroboration, or named affected client site has surfaced in subsequent searches. Given the single-source, same-day nature of this disclosure, defenders embedding Adform tags should treat this as an active, unconfirmed incident and prioritize network-layer blocking and IOC/content-signature hunting over waiting on vendor confirmation.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Collection

T1056 Input Capture; T1115 Clipboard Data; T1119 Automated Collection; T1185 Browser Session Hijacking

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1571 Non-Standard Port

Initial Access

T1189 Drive-by Compromise; T1195 Supply Chain Compromise; T1199 Trusted Relationship

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1608 Stage Capabilities

Impact

T1657 Financial Theft

Remediation

Patches

• No vendor patch, hotfix, or public security advisory has been published by Adform as of this writing; monitor Adform's official channels and DoublePulsar for confirmation of remediation

Immediate actions

• Block outbound network connections to 84.32.102.230 (TCP/7744) at perimeter firewalls, web proxies, and EDR network filters; consider monitoring the broader 84.32.102.0/24 (Cherry Servers, AS59642) range for related short-lived infrastructure
• Temporarily disable, sandbox, or proxy-block embeds of https://s2.adform.net/banners/scripts/st/trackpoint-async.js on client-owned sites pending vendor confirmation of remediation
• Hunt for SHA256 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55 and the beacon URL pattern hxxp://84.32.102.230:7744/p?h=*&u=* across web proxy, CDN, and browser-security telemetry
• Deploy content-inspection/SRI-diff monitoring that flags scripts containing the BTC/ETH/TRX wallet-detection regexes (`\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,62}\b`, `\b0x[a-fA-F0-9]{40}\b`, `\bT[1-9A-HJ-NP-Za-km-z]{33}\b`) or the XOR decode key sequence `4d 33 77 54 77 30`, both distinctive of this payload
• Notify users/customers of sites embedding Adform tags to manually verify the full cryptocurrency wallet address after any copy/paste before broadcasting a transaction

Workarounds

• Ad-block or network-block the specific script path banners/scripts/st/trackpoint-async.js on s2.adform.net until vendor confirmation is available
• Disable clipboard auto-paste/auto-fill in cryptocurrency wallet browser extensions and manually re-verify pasted addresses character-by-character

Longer-term hardening

• Adopt Subresource Integrity (SRI) hashes and a strict Content-Security-Policy script-src allowlist for all third-party ad-tech, analytics, and tag-manager scripts
• Deploy continuous client-side (browser-execution) supply-chain monitoring to detect unauthorized changes to previously-trusted third-party script content, including runtime `Object.defineProperty` prototype-hooking and `MutationObserver`-based DOM tampering
• Require ad-tech/analytics vendors to provide signed releases, change-notification feeds, and SRI-compatible hashes for syndicated scripts
• Encourage use of hardware wallets or wallet software with on-device address/QR verification, which are not defeated by clipboard-substitution or input-hijacking attacks

Affected and fixed versions

• Adform — Adform DSP tracking/beacon script (trackpoint-async.js served from s2.adform.net)
  Vulnerable versions: Live production copy of s2.adform.net/banners/scripts/st/trackpoint-async.js as served during the disclosed compromise window (exact build/version not disclosed by source)
  Fixed in: Not confirmed by vendor at time of publication

Timeline

• 2026-07-23 Approximate start of the observation window; the disclosing researcher describes malicious clipboard-hijacking activity as having been present 'over the preceding week' relative to publication — exact compromise start date not confirmed by Adform.
• 2026-07-30 Follow-up research finds no additional vendor statement, independent researcher corroboration, named affected client site, or BeaconBeagle correlation record for locked-ioc-8 as of this research pass — the incident remains single-source.
• 2026-07-30 Adform has not issued a public security advisory or confirmed the compromise or its remediation status as of publication.
• 2026-07-30 DoublePulsar publishes the public disclosure. No CVE is assigned and no CVSS score exists as of publication.
• 2026-07-30 IOCs (compromised script URL, C2 IP:port, SHA256 hash, wallet-detection regexes, XOR decode key) are publicly disclosed to enable defender detection ahead of any formal vendor advisory.
• 2026-07-30 Author observes the malicious code beginning to disappear from the live script mid-investigation, consistent with either quiet vendor-side remediation or attacker withdrawal upon discovery; neither is confirmed.
• 2026-07-30 Author confirms the malicious file returns a clean, zero-detection result across all VirusTotal antivirus vendor engines despite verified malicious clipboard-hijacking behavior.
• 2026-07-30 An excerpt of the malicious payload — including the BTC/ETH/TRX wallet-matching regex patterns, the XOR-encoded replacement wallet addresses, and the clipboard/DOM/input-hooking logic (MutationObserver, TreeWalker, Object.defineProperty on HTMLInputElement.prototype.value) — is published via pastebin.com/mc7psaNF alongside the disclosure, enabling independent code-level verification.
• 2026-07-30 Investigation extracts the compromised file's SHA256 hash (locked-ioc-1) and identifies the C2 beacon endpoint at locked-ioc-8:7744.
• 2026-07-30 Kevin Beaumont (DoublePulsar) identifies that Adform's locked-ioc-5 tracking script, embedded across ~14,000 client sites, has been modified to serve a clipboard-hijacking cryptocurrency clipper.

Sources cited

• Hijacked at the Source: AppsFlyer SDK Crypto Stealer (CSA Research Note) labs.cloudsecurityalliance.org · Research · 2026-03-18
• Group-IB High-Tech Crime Trends 2026: Supply Chain Attacks Emerge as Top Global Cyber Threat group-ib.com · Research
• Compromise Software Supply Chain (T1195.002) — MITRE ATT&CK MITRE · Research
• Clipboard Data (T1115) — MITRE ATT&CK MITRE · Research
• Deobfuscate/Decode Files or Information (T1140) — MITRE ATT&CK MITRE · Research
• Browser Session Hijacking (T1185) — MITRE ATT&CK MITRE · Research
• Credential API Hooking (T1056.004) — MITRE ATT&CK MITRE · Research
• Extracted malicious payload from compromised trackpoint-async.js (code excerpt) pastebin.com · Proof of concept · 2026-07-30
• Adform compromised to serve crypto stealer via supply chain attack doublepulsar.com · Blog · 2026-07-30
• CISO Executive Briefing: Supply Chain Front-End Compromises and Sustained Third-Party Risk Elevation veracode.com · Blog · 2026-07-08
• CountLoader-delivered JavaScript malware campaign drops cryptocurrency clipper via PowerShell gbhackers.com · Blog

More in supply chain

• Cursor Supply-Chain Compromise: Leaked Fireworks AI Key Leads to Backdoored Anthropic.claude-code Extension (2.1.312/2.1.313) in Cursor Marketplace Cache
• nDiligence 'Attack the Glass' (ATG): Runtime Client-Side Rendering Supply-Chain Vulnerability Class Across 50 Platform Types
• Binance Hack: Tampered Homebrew Package Delivers macOS Stealer; Infostealers and AI-Powered Profiling Feed Social Engineering (TraderTraitor attribution)
• wfx-loot: GitHub Actions CI secret stealer pushed to public repositories using stolen GitHub credentials
• Quantum Systems QBase ground-control software update reportedly malware-laden; Bundeswehr drones grounded as precaution

Previous and next in supply chain

• Joyfill npm Packages Compromised with Blockchain C2 Loader Previous report
• AI Agent (Claude Mythos 5) Publishes Credential-Stealing Package 'mlflow-ui' to PyPI During Cyber Evaluation; 15 Real Systems Execute It Next report

Further reading

• Axios Supply Chain Attack: Cross-Platform RATs
• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• npm Supply Chain Attacks 2026: 218 Packages