Adform Ad-Tech Platform Compromised: Supply-Chain Injection Serves Clipboard Crypto Stealer via trackpoint-async.js

Adform Ad-Tech Platform Compromised (TL-2026-1775) is a high-severity supply-chain compromise, first published 2026-07-30. It has no confirmed attribution, affects Adform Adform DSP tracking/beacon script (trackpoint-async.js served, maps to 18 MITRE ATT&CK techniques (T1027, T1036, T1041), and is covered by 9 detection rules and 25 indicators of compromise.

Key facts for TL-2026-1775

Threat ID
TL-2026-1775
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-30
Last reviewed
2026-07-30
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
advertisingtechnology, mediaandpublishing, ecommerce, retail, financialservices, technology
Target regions
Global
Detection rules
9
Indicators of compromise
25

Malware and tooling in Adform Ad-Tech Platform Compromised

Malware and tooling: browser-based-crypto-clipper (unattributed)

Adform, a demand-side advertising platform with roughly 14,000 clients and ~30% DSP market share, had its widely embedded tracking script (s2.adform.net/banners/scripts/st/trackpoint-async.js) compromised to serve a clipboard-hijacking cryptocurrency clipper that swaps BTC/ETH/TRX wallet addresses for attacker-controlled ones and logs visitor IP, referrer, and URL path to a C2 server hosted at Cherry Servers (AS59642, Amsterdam, NL). The payload returns clean across all VirusTotal engines, no CVE/vendor advisory exists, and the malicious code was observed disappearing mid-investigation with no confirmed remediation.

How Adform Ad-Tech Platform Compromised works

On 2026-07-30, independent researcher Kevin Beaumont (DoublePulsar) disclosed that Adform's widely embedded third-party tracking asset, s2.adform.net/banners/scripts/st/trackpoint-async.js, had been modified to deliver a browser-based cryptocurrency clipboard clipper to every visitor of any of the roughly 14,000 downstream client sites embedding it. Adform holds an estimated 30% share of the demand-side platform (DSP) market, making this a high-reach, front-end software-supply-chain compromise: the trust relationship between a widely-syndicated ad-tech vendor and its client websites (and, transitively, those clients' visitors) was abused to distribute malware without any action required by the end user beyond loading a page that embeds the tag.

The injected payload polls the browser clipboard on a fixed interval (the disclosure describes ~3 seconds; code-level analysis of the extracted excerpt shows a 4-second `setInterval` loop — both are consistent with continuous, near-real-time polling), inspecting copied and typed text against three hardcoded regular expressions matching well-formed wallet address formats: Bitcoin (`\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,62}\b`), Ethereum (`\b0x[a-fA-F0-9]{40}\b`), and TRON/TRX (`\bT[1-9A-HJ-NP-Za-km-z]{33}\b`). When a match is found, the script silently substitutes the victim's copied or typed address with one of three attacker-controlled replacement addresses that are stored XOR-encoded in the payload (decode key `[0x4d,0x33,0x77,0x54,0x77,0x30]`) and only decoded at runtime — a lightweight but deliberate anti-static-analysis measure consistent with the payload's zero-detection VirusTotal status. The substitution logic re-asserts itself even if the victim re-copies the legitimate address, indicating a persistent polling/overwrite loop rather than a one-shot swap.

Code-level analysis of the payload (extracted and published via pastebin.com/mc7psaNF alongside the disclosure) shows the clipper goes well beyond a simple clipboard-read/write loop: it registers listeners for `input`, `copy`, `cut`, and `paste` events; walks the DOM with `document.createTreeWalker()` to scan text nodes and input/textarea elements for wallet-pattern matches as they are added; uses a `MutationObserver` to catch dynamically inserted content; and hijacks `HTMLInputElement.prototype.value` via `Object.defineProperty()` so that reads/writes to input fields are transparently intercepted and rewritten — meaning the substitution can occur even where the site's own JavaScript, not just the user's clipboard, sets the field value. Minified single-letter variable/function names (`_k`, `_d`, `_r`, `_w`, `_obs`, `_cp`, `_bn`, `_scanText`) and regex patterns stored as object properties rather than inline literals are additional lightweight obfuscation choices.

Independent of the financial theft function, the script also collects and exfiltrates the visitor's IP address (implicitly, via the HTTP connection to the beacon), HTTP referrer, and current URL path from any page that loads it — telemetry with no legitimate tracking justification and clear privacy/surveillance implications across the entire embedding client base. Exfiltration and address-replacement configuration are served from attacker infrastructure at 84.32.102.230 over TCP port 7744, using a simple HTTP beacon of the form http://84.32.102.230:7744/p?h={embedding_hostname}&u={url_path}. Infrastructure lookup attributes 84.32.102.230 to Cherry Servers (legal entity UAB Nacionalinis Telekomunikaciju Tinklas), ASN AS59642, a commercial VPS/hosting provider based in Amsterdam, Netherlands (reverse DNS ip-84-32-102-230.009.ptr.cherryservers.net) — a low-cost, rapidly-provisionable hosting choice typical of short-lived C2 collection endpoints rather than a mature, multi-layered C2 framework. A BeaconBeagle lookup against 84.32.102.230 returned no existing beacon/campaign correlation record at time of research, indicating this endpoint is not yet linked to previously catalogued C2 infrastructure or malware families in that dataset.

The compromised script file itself carries SHA256 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55 and, as of publication, returns a clean (zero-detection) verdict across all VirusTotal vendor engines despite confirmed malicious clipboard-hijacking behavior — a meaningful detection gap for any defender relying on AV/reputation scoring alone rather than behavioral, network, or content-inspection-based indicators (e.g., matching the wallet-detection regexes or the XOR decode key against script content).

As of publication there is no CVE assignment, no CVSS score, and no public vendor advisory or remediation confirmation from Adform. The disclosing researcher noted that the malicious code appeared to be disappearing from the live script mid-investigation, which could indicate either quiet vendor-side remediation or the attacker pulling the implant upon discovery — neither has been confirmed. No attribution to a known threat actor or malware family has been established; the clipper itself has not been named or linked to a previously catalogued crypto-clipper family (e.g., Laplas, CountLoader-delivered clippers) by the source, and no follow-up vendor statement, additional researcher corroboration, or named affected client site has surfaced in subsequent searches. Given the single-source, same-day nature of this disclosure, defenders embedding Adform tags should treat this as an active, unconfirmed incident and prioritize network-layer blocking and IOC/content-signature hunting over waiting on vendor confirmation.

MITRE ATT&CK techniques used in TL-2026-1775

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Collection

T1056 Input Capture; T1115 Clipboard Data; T1119 Automated Collection; T1185 Browser Session Hijacking

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1571 Non-Standard Port

Initial Access

T1189 Drive-by Compromise; T1195 Supply Chain Compromise; T1199 Trusted Relationship

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1608 Stage Capabilities

Impact

T1657 Financial Theft

Affected products and versions in Adform Ad-Tech Platform Compromised

  • Adform — Adform DSP tracking/beacon script (trackpoint-async.js served from s2.adform.net)
    Vulnerable versions: Live production copy of s2.adform.net/banners/scripts/st/trackpoint-async.js as served during the disclosed compromise window (exact build/version not disclosed by source)
    Fixed in: Not confirmed by vendor at time of publication

Remediation for Adform Ad-Tech Platform Compromised

Patches

  • No vendor patch, hotfix, or public security advisory has been published by Adform as of this writing; monitor Adform's official channels and DoublePulsar for confirmation of remediation

Immediate actions

  • Block outbound network connections to 84.32.102.230 (TCP/7744) at perimeter firewalls, web proxies, and EDR network filters; consider monitoring the broader 84.32.102.0/24 (Cherry Servers, AS59642) range for related short-lived infrastructure
  • Temporarily disable, sandbox, or proxy-block embeds of https://s2.adform.net/banners/scripts/st/trackpoint-async.js on client-owned sites pending vendor confirmation of remediation
  • Hunt for SHA256 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55 and the beacon URL pattern hxxp://84.32.102.230:7744/p?h=*&u=* across web proxy, CDN, and browser-security telemetry
  • Deploy content-inspection/SRI-diff monitoring that flags scripts containing the BTC/ETH/TRX wallet-detection regexes (`\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,62}\b`, `\b0x[a-fA-F0-9]{40}\b`, `\bT[1-9A-HJ-NP-Za-km-z]{33}\b`) or the XOR decode key sequence `4d 33 77 54 77 30`, both distinctive of this payload
  • Notify users/customers of sites embedding Adform tags to manually verify the full cryptocurrency wallet address after any copy/paste before broadcasting a transaction

Workarounds

  • Ad-block or network-block the specific script path banners/scripts/st/trackpoint-async.js on s2.adform.net until vendor confirmation is available
  • Disable clipboard auto-paste/auto-fill in cryptocurrency wallet browser extensions and manually re-verify pasted addresses character-by-character

Longer-term hardening

  • Adopt Subresource Integrity (SRI) hashes and a strict Content-Security-Policy script-src allowlist for all third-party ad-tech, analytics, and tag-manager scripts
  • Deploy continuous client-side (browser-execution) supply-chain monitoring to detect unauthorized changes to previously-trusted third-party script content, including runtime `Object.defineProperty` prototype-hooking and `MutationObserver`-based DOM tampering
  • Require ad-tech/analytics vendors to provide signed releases, change-notification feeds, and SRI-compatible hashes for syndicated scripts
  • Encourage use of hardware wallets or wallet software with on-device address/QR verification, which are not defeated by clipboard-substitution or input-hijacking attacks

Weaknesses (CWE) in Adform Ad-Tech Platform Compromised

CWE-829, CWE-1357, CWE-506

Timeline of Adform Ad-Tech Platform Compromised

  • Approximate start of the observation window; the disclosing researcher describes malicious clipboard-hijacking activity as having been present 'over the preceding week' relative to publication — exact compromise start date not confirmed by Adform.
  • Follow-up research finds no additional vendor statement, independent researcher corroboration, named affected client site, or BeaconBeagle correlation record for 84.32.102.230 as of this research pass — the incident remains single-source.
  • Adform has not issued a public security advisory or confirmed the compromise or its remediation status as of publication.
  • DoublePulsar publishes the public disclosure. No CVE is assigned and no CVSS score exists as of publication.
  • IOCs (compromised script URL, C2 IP:port, SHA256 hash, wallet-detection regexes, XOR decode key) are publicly disclosed to enable defender detection ahead of any formal vendor advisory.
  • Author observes the malicious code beginning to disappear from the live script mid-investigation, consistent with either quiet vendor-side remediation or attacker withdrawal upon discovery; neither is confirmed.
  • Author confirms the malicious file returns a clean, zero-detection result across all VirusTotal antivirus vendor engines despite verified malicious clipboard-hijacking behavior.
  • An excerpt of the malicious payload — including the BTC/ETH/TRX wallet-matching regex patterns, the XOR-encoded replacement wallet addresses, and the clipboard/DOM/input-hooking logic (MutationObserver, TreeWalker, Object.defineProperty on HTMLInputElement.prototype.value) — is published via pastebin.com/mc7psaNF alongside the disclosure, enabling independent code-level verification.
  • Investigation extracts the compromised file's SHA256 hash (02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55) and identifies the C2 beacon endpoint at 84.32.102.230:7744.
  • Kevin Beaumont (DoublePulsar) identifies that Adform's trackpoint-async.js tracking script, embedded across ~14,000 client sites, has been modified to serve a clipboard-hijacking cryptocurrency clipper.

Sources cited for Adform Ad-Tech Platform Compromised

Threats related to Adform Ad-Tech Platform Compromised

Detection coverage for TL-2026-1775

As of 2026-07-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1775 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats