# Adform Ad-Tech Platform Compromised: Supply-Chain Injection Serves Clipboard Crypto Stealer via trackpoint-async.js

> Adform, a demand-side advertising platform with roughly 14,000 clients and ~30% DSP market share, had its widely embedded tracking script (s2.adform.net/banners/scripts/st/trackpoint-async.js) compromised to serve a clipboard-hijacking cryptocurrency clipper that swaps BTC/ETH/TRX wallet addresses for attacker-controlled ones and logs visitor IP, referrer, and URL path to a C2 server hosted at Cherry Servers (AS59642, Amsterdam, NL). The payload returns clean across all VirusTotal engines, no CVE/vendor advisory exists, and the malicious code was observed disappearing mid-investigation with no confirmed remediation.

- **Published:** 2026-07-30T00:00:00Z
- **Last reviewed:** 2026-07-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1775
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-adform-trackpoint-async-js-clipper-tl-2026-1775.webp?v=9894651f (Threadlinqs threat intel: Adform trackpoint-async.js Clipper: Detection & IOCs (TL-2026-1775) — High severity, 25 IOCs, 9 detection rules.)
- **ID:** TL-2026-1775
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)

## Description

On 2026-07-30, independent researcher Kevin Beaumont (DoublePulsar) disclosed that Adform's widely embedded third-party tracking asset, s2.adform.net/banners/scripts/st/trackpoint-async.js, had been modified to deliver a browser-based cryptocurrency clipboard clipper to every visitor of any of the roughly 14,000 downstream client sites embedding it. Adform holds an estimated 30% share of the demand-side platform (DSP) market, making this a high-reach, front-end software-supply-chain compromise: the trust relationship between a widely-syndicated ad-tech vendor and its client websites (and, transitively, those clients' visitors) was abused to distribute malware without any action required by the end user beyond loading a page that embeds the tag.

The injected payload polls the browser clipboard on a fixed interval (the disclosure describes ~3 seconds; code-level analysis of the extracted excerpt shows a 4-second `setInterval` loop — both are consistent with continuous, near-real-time polling), inspecting copied and typed text against three hardcoded regular expressions matching well-formed wallet address formats: Bitcoin (`\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,62}\b`), Ethereum (`\b0x[a-fA-F0-9]{40}\b`), and TRON/TRX (`\bT[1-9A-HJ-NP-Za-km-z]{33}\b`). When a match is found, the script silently substitutes the victim's copied or typed address with one of three attacker-controlled replacement addresses that are stored XOR-encoded in the payload (decode key `[0x4d,0x33,0x77,0x54,0x77,0x30]`) and only decoded at runtime — a lightweight but deliberate anti-static-analysis measure consistent with the payload's zero-detection VirusTotal status. The substitution logic re-asserts itself even if the victim re-copies the legitimate address, indicating a persistent polling/overwrite loop rather than a one-shot swap.

Code-level analysis of the payload (extracted and published via pastebin.com/mc7psaNF alongside the disclosure) shows the clipper goes well beyond a simple clipboard-read/write loop: it registers listeners for `input`, `copy`, `cut`, and `paste` events; walks the DOM with `document.createTreeWalker()` to scan text nodes and input/textarea elements for wallet-pattern matches as they are added; uses a `MutationObserver` to catch dynamically inserted content; and hijacks `HTMLInputElement.prototype.value` via `Object.defineProperty()` so that reads/writes to input fields are transparently intercepted and rewritten — meaning the substitution can occur even where the site's own JavaScript, not just the user's clipboard, sets the field value. Minified single-letter variable/function names (`_k`, `_d`, `_r`, `_w`, `_obs`, `_cp`, `_bn`, `_scanText`) and regex patterns stored as object properties rather than inline literals are additional lightweight obfuscation choices.

Independent of the financial theft function, the script also collects and exfiltrates the visitor's IP address (implicitly, via the HTTP connection to the beacon), HTTP referrer, and current URL path from any page that loads it — telemetry with no legitimate tracking justification and clear privacy/surveillance implications across the entire embedding client base. Exfiltration and address-replacement configuration are served from attacker infrastructure at 84.32.102.230 over TCP port 7744, using a simple HTTP beacon of the form http://84.32.102.230:7744/p?h={embedding_hostname}&u={url_path}. Infrastructure lookup attributes 84.32.102.230 to Cherry Servers (legal entity UAB Nacionalinis Telekomunikaciju Tinklas), ASN AS59642, a commercial VPS/hosting provider based in Amsterdam, Netherlands (reverse DNS ip-84-32-102-230.009.ptr.cherryservers.net) — a low-cost, rapidly-provisionable hosting choice typical of short-lived C2 collection endpoints rather than a mature, multi-layered C2 framework. A BeaconBeagle lookup against 84.32.102.230 returned no existing beacon/campaign correlation record at time of research, indicating this endpoint is not yet linked to previously catalogued C2 infrastructure or malware families in that dataset.

The compromised script file itself carries SHA256 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55 and, as of publication, returns a clean (zero-detection) verdict across all VirusTotal vendor engines despite confirmed malicious clipboard-hijacking behavior — a meaningful detection gap for any defender relying on AV/reputation scoring alone rather than behavioral, network, or content-inspection-based indicators (e.g., matching the wallet-detection regexes or the XOR decode key against script content).

As of publication there is no CVE assignment, no CVSS score, and no public vendor advisory or remediation confirmation from Adform. The disclosing researcher noted that the malicious code appeared to be disappearing from the live script mid-investigation, which could indicate either quiet vendor-side remediation or the attacker pulling the implant upon discovery — neither has been confirmed. No attribution to a known threat actor or malware family has been established; the clipper itself has not been named or linked to a previously catalogued crypto-clipper family (e.g., Laplas, CountLoader-delivered clippers) by the source, and no follow-up vendor statement, additional researcher corroboration, or named affected client site has surfaced in subsequent searches. Given the single-source, same-day nature of this disclosure, defenders embedding Adform tags should treat this as an active, unconfirmed incident and prioritize network-layer blocking and IOC/content-signature hunting over waiting on vendor confirmation.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1189 Drive-by Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1115 Clipboard Data
- T1119 Automated Collection
- T1185 Browser Session Hijacking
- T1056 Input Capture
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Compromised Adform trackpoint-async.js — SHA256/URL Match in Web Proxy Logs** (`TL-2026-1775-SPL-001`)

Detects direct retrieval of the confirmed-malicious Adform tracking script by exact SHA256 hash or compromised URL path, indicating a client browser loaded the trackpoint-async.js supply-chain payload behind TL-2026-1775.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1199, T1036
- **Data sources:** web_proxy, stream:http, squid, zscaler
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="stream:http" (url="*s2.adform.net/banners/scripts/st/trackpoint-async.js*" OR file_hash="02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55")
| eval match_reason=if(match(url, "trackpoint-async\.js"), "compromised_url_match", "sha256_hash_match")
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(src_ip) as src_ips by url, file_hash, match_reason
| where count > 0
| sort -last_seen
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has "s2.adform.net/banners/scripts/st/trackpoint-async.js" or FileHash =~ "02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55"
| extend MatchReason = iff(RequestURL has "trackpoint-async.js", "compromised_url_match", "sha256_hash_match")
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, FileHash, MatchReason, DeviceVendor
| order by TimeGenerated desc
```

### Sigma

```yaml
title: Compromised Adform trackpoint-async.js Script Retrieved (Hash or URL Match)
id: e4a1c2d3-1775-4b8a-9f01-aa1775000001
status: experimental
description: Detects retrieval of the confirmed-malicious Adform trackpoint-async.js supply-chain payload by exact SHA256 hash or compromised URL path (TL-2026-1775).
references:
    - https://doublepulsar.com/adform-compromised-to-serve-crypto-stealer-via-supply-chain-attack-2f1ec024f33e
    - https://pastebin.com/mc7psaNF
author: Threadlinqs Team
date: 2026/07/30
tags:
    - attack.initial_access
    - attack.t1195.002
    - attack.t1199
    - attack.t1036
logsource:
    category: proxy
    product: network
detection:
    selection_url:
        c-uri|contains: 's2.adform.net/banners/scripts/st/trackpoint-async.js'
    selection_hash:
        FileHash: '02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55'
    condition: selection_url or selection_hash
fields:
    - src_ip
    - dst_ip
    - c-uri
    - FileHash
falsepositives:
    - None expected while the compromise is unremediated; re-verify hash against vendor confirmation before treating future matches as benign
level: critical
```

**Known false positives:**

- Legitimate access to a remediated/clean version of trackpoint-async.js after Adform rotates the file hash — verify hash currency before alerting

**Tuning notes:** Update the SHA256 IOC immediately once Adform confirms remediation and publishes a new clean-file hash, otherwise this detection will false-positive on the legitimate patched script; until then treat any hit as confirmed compromise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Ad-Tech Script Integrity Drift — Unexpected Hash Change on Trusted [indicator] Domain (locked: unlock with TL Creds)
- Repeated Clipboard/Input Wallet-Address Overwrite Pattern (Post-Copy Reassertion Loop) via Endpoint DLP Telemetry (locked: unlock with TL Creds)
- OSINT-Corroborated Sibling Infrastructure Sweep — Community-Observed Magecart-Cluster Domains Alongside Confirmed C2 (locked: unlock with TL Creds)
- Masquerading Trusted Ad-Tech Domain Serving Compromised [indicator] (Trusted-Relationship Abuse) (locked: unlock with TL Creds)
- Object.defineProperty Input-Value Hijack + MutationObserver/TreeWalker DOM-Scan Signature in Page Script (locked: unlock with TL Creds)
- Full Kill-Chain Correlation — Compromised Adform Script Load Followed by Non-Standard-Port Exfil Beacon (locked: unlock with TL Creds)
- Wallet-Address Regex & XOR Decode-Key Byte Sequence in Third-Party Script Content (locked: unlock with TL Creds)
- Non-Standard-Port C2 Beacon to [indicator]:7744 / Cherry Servers CIDR (h=/u= Beacon Shape) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `84.32.102[.]230`
- URL: `hxxps://pastebin[.]com/mc7psaNF`
- File hash: `02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Adform compromised to serve crypto stealer via supply chain attack](https://doublepulsar.com/adform-compromised-to-serve-crypto-stealer-via-supply-chain-attack-2f1ec024f33e?source=rss----8343faddf0ec---4)
- [Extracted malicious payload from compromised trackpoint-async.js (code excerpt)](https://pastebin.com/mc7psaNF)
- [Hijacked at the Source: AppsFlyer SDK Crypto Stealer (CSA Research Note)](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/03/CSA_research_note_appsflyer_sdk_supply_chain_crypto_stealer_20260318-csa-styled.pdf)
- [CISO Executive Briefing: Supply Chain Front-End Compromises and Sustained Third-Party Risk Elevation](https://www.veracode.com/blog/supply-chain-compromises-from-june-and-july-2026/)
- [Group-IB High-Tech Crime Trends 2026: Supply Chain Attacks Emerge as Top Global Cyber Threat](https://www.group-ib.com/media-center/press-releases/htct-2026-supply-chain/)
- [Compromise Software Supply Chain (T1195.002) — MITRE ATT&CK](https://attack.mitre.org/techniques/T1195/002/)
- [Clipboard Data (T1115) — MITRE ATT&CK](https://attack.mitre.org/techniques/T1115/)
- [Deobfuscate/Decode Files or Information (T1140) — MITRE ATT&CK](https://attack.mitre.org/techniques/T1140/)
- [Browser Session Hijacking (T1185) — MITRE ATT&CK](https://attack.mitre.org/techniques/T1185/)
- [Credential API Hooking (T1056.004) — MITRE ATT&CK](https://attack.mitre.org/techniques/T1056/004/)
- [CountLoader-delivered JavaScript malware campaign drops cryptocurrency clipper via PowerShell](https://gbhackers.com/javascript-malware-campaign/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1775