Adform Ad-Tech Platform Compromised: Trojanized Tracking Script Serves Crypto Clipboard Stealer via Supply-Chain Attack

Key facts

Detection coverage

As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2656 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Browser Process Outbound Connection to Adform Clipper C2 (Clipboard/DOM Collection Callback)

Detects a browser process (Chrome, Edge, Firefox) establishing an outbound connection to the hardcoded C2 IP:port 84.32.102.230:7744 used by the trojanized trackpoint-async.js payload to exfiltrate the visited hostname/path once the clipboard-polling and DOM/event-hijacking blocks have executed in-page. Endpoint-level evidence that the malicious JavaScript ran and attempted its collection callback.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.007, T1027, T1119, T1115
• Data sources: sysmon, windows_security, edr_network_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "crowdstrike:events:sensor", "carbon_black") EventCode=3
| eval browser_proc=if(match(Image, "(?i)(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|opera\.exe|brave\.exe)$"), 1, 0)
| where browser_proc=1 AND DestinationIp="84.32.102.230" AND DestinationPort=7744
| table _time, host, Image, User, DestinationIp, DestinationPort
| sort -_time

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "opera.exe", "brave.exe")
| where RemoteIP == "84.32.102.230" and RemotePort == 7744
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteIP, RemotePort, RemoteUrl
| sort by Timestamp desc

Sigma

title: Browser Outbound Connection to Adform Clipper C2 Endpoint
id: 4e8a1d2c-9f3b-4a67-b1e0-5c7d3f9a6b21
status: experimental
description: Detects a common browser process connecting to the hardcoded C2 IP and non-standard port used by the trojanized Adform trackpoint-async.js payload to exfiltrate visited hostname/path after clipboard-polling and DOM/event-hijacking blocks execute.
references:
    - https://hecavex.com/en/research/adform-supply-chain-crypto-clipper/
author: Threadlinqs Team
date: 2026-09-26
tags:
    - attack.collection
    - attack.execution
    - attack.defense-evasion
    - attack.t1059.007
    - attack.t1027
    - attack.t1119
    - attack.t1115
logsource:
    category: network_connection
    product: windows
detection:
    selection_process:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\iexplore.exe'
            - '\opera.exe'
            - '\brave.exe'
    selection_dest:
        DestinationIp: '84.32.102.230'
        DestinationPort: 7744
    condition: selection_process and selection_dest
falsepositives:
    - Extremely unlikely; this IP:port pair has no known legitimate service — treat any match as high-fidelity
level: critical

Known false positives:

• None expected under normal conditions; the destination IP:port is attacker-controlled infrastructure with no legitimate purpose

Tuning notes: If EDR network telemetry is unavailable, fall back to DNS/proxy logs for the same IP; note that HTTPS-embedding pages will block this via mixed-content policy client-side, so absence of a hit does not confirm the script was not executed — cross-reference with SPL-001/KQL-001 script-delivery detections.

• 🔒 Trojanized [indicator] Delivery via Proxy Telemetry (Sentinel) · unlock with TL Creds
• 🔒 Defender for Endpoint: Browser Callback to Adform Clipper C2 IP · unlock with TL Creds
• 🔒 Sentinel: Mass Beacon Pattern to Adform Clipper C2 Across the Estate · unlock with TL Creds
• 🔒 Sigma: Trojanized Adform [indicator] Script Delivery · unlock with TL Creds
• 🔒 Sigma: Browser Outbound Connection to Adform Clipper C2 Endpoint · unlock with TL Creds
• 🔒 Sigma: Mass Beacon to Adform Clipper C2 IP Across Multiple Hosts · unlock with TL Creds
• 🔒 Trojanized Adform [indicator] Delivery (Supply-Chain Content Injection) · unlock with TL Creds
• 🔒 Mass Beacon Pattern to Adform Clipper C2 Across Multiple Internal Hosts · unlock with TL Creds

Indicators of compromise

As of 2026-09-26, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-2656.

Sample indicators (3 of 10)

• IP address: 84.32.102[.]230
• Domain: s2[.]adform[.]net
• File hash: 0674a58b224cca2ce840153d6c8d474f29f126f7af5054350ba1572c33233aa3

Defanged, TLP:CLEAR. Full set of 10 indicators: unlock with TL Creds.

Technical analysis

Discovered by security researcher Kevin Beaumont (DoublePulsar) and disclosed 2026-07-31; Adform detected and removed the malicious code on 2026-07-27, reporting no evidence of installed persistence.

Adform, an advertising-technology company whose demand-side-platform tag is embedded on an estimated ~14,000 businesses' websites across 180+ countries, had its trackpoint-async.js tracking script trojanized. The legitimate 82,727-byte library had a 6,945-byte malicious suffix appended containing two functional blocks, per byte-level analysis published by independent researcher HECAVEX (corroborating Max Maass's public sample capture): an early block that polled the clipboard on an interval and reported page telemetry over plaintext HTTP, and a more advanced block that additionally walked the rendered DOM with a TreeWalker to rewrite wallet-address strings in text nodes, <input>/<textarea>/contenteditable elements, and hooked the value-setter and copy/cut/paste/input events so that both user-pasted and programmatically-written values were intercepted and replaced while the cursor position was preserved to avoid alerting the visitor.

The replacement logic matched common Bitcoin, Ethereum, and TRON address formats and substituted attacker-controlled strings obfuscated behind a six-byte XOR key. The captured samples show at least three distinct variants of increasing capability, one of which contained a malformed (checksum-invalid) TRON replacement string, suggesting active iteration by the attacker during the exposure window. A hardcoded request to 84.32.102.230:7744 transmitted the visiting page's hostname and URL path on load; the endpoint used plaintext HTTP on a non-standard port, meaning the request was blocked by browser mixed-content policy on any embedding page served over HTTPS. Adform stated it found no evidence of successful data transmission or installed persistent software, and that the code stopped operating once the affected page was closed.

The oldest known evidence is an Archive.org snapshot capturing the malicious code at 2026-07-26 23:29:03 GMT. Adform detected the anomalous activity and removed the malicious code on 2026-07-27, notifying affected clients and reporting the incident to authorities. Kevin Beaumont publicly disclosed the compromise on 2026-07-31, noting he had observed suspicious activity for longer than Adform's stated detection window (a discrepancy that remains unresolved). Independent verification via URLScan.io shows the poisoned script (matching the most advanced payload hash) was also served from a secondary/mirrored hostname (s1.matas.se) using the same script path, indicating exposure was not limited to the primary s2.adform.net host alone. The captured sample ran undetected by every VirusTotal antivirus engine at time of analysis, consistent with browser-only, non-persistent JavaScript payloads generally evading endpoint-focused detection tooling. No threat actor has been publicly attributed, and open questions remain around the full list of affected websites, total visitor exposure, the initial compromise vector into Adform's script pipeline, and whether any cryptocurrency was actually diverted.

MITRE ATT&CK techniques by tactic:

Stealth

T1027 Obfuscated Files or Information

Execution

T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols

Collection

T1119 Automated Collection

Initial Access

T1195.002 Compromise Software Supply Chain; T1659 Content Injection

Impact

T1657 Financial Theft

Remediation

Patches

• Adform removed the malicious code from trackpoint-async.js on 2026-07-27; embedding sites need only ensure they are fetching the current, clean script (no local patch is applicable since the compromise was server-side at the vendor)

Immediate actions

• Block outbound network traffic to 84.32.102.230:7744 at the perimeter/firewall layer
• Audit all third-party/ad-tech scripts embedded on production websites, including any Adform tags, for supply-chain integrity
• Clear browser cache on endpoints that visited sites embedding trackpoint-async.js around 2026-07-27
• Confirm with Adform or affected vendors whether embedded sites served the compromised script and during what window

Workarounds

• Prefer hardware wallets with independent, on-device address-display confirmation for cryptocurrency transactions
• Disable or sandbox third-party ad/tag scripts on pages where users handle cryptocurrency addresses

Longer-term hardening

• Adopt Subresource Integrity (SRI) hashes and Content-Security-Policy script-src allowlisting for all third-party ad/tag scripts
• Monitor Adform and other ad-tech vendor security advisories for follow-up disclosures
• Educate users and customers to manually verify cryptocurrency wallet addresses character-by-character rather than trusting pasted clipboard content
• Review recent cryptocurrency transactions on affected systems for signs of address substitution

Affected and fixed versions

• Adform — trackpoint-async.js JavaScript tracking/tag script (served via s2.adform.net)
  Vulnerable versions: Script instance served between 2026-07-26T23:29:03Z (earliest known archive snapshot) and remediation on 2026-07-27
  Fixed in: Script instance served by Adform after the 2026-07-27 remediation

Timeline

• 2026-07-26 Archive.org captures the trojanized locked-ioc-6 at 23:29:03 GMT, the earliest known snapshot containing the malicious payload appended to the legitimate script.
• 2026-07-27 Adform notifies affected clients of the incident and reports the event to authorities.
• 2026-07-27 Adform detects the suspicious activity and removes the malicious code from locked-ioc-6, finding no evidence of persistence beyond the open page.
• 2026-07-30 A URLScan.io capture records the most advanced payload variant (SHA-256 locked-ioc-3) served from a mirrored hostname (locked-ioc-9) at the same script path, indicating exposure beyond the primary locked-ioc-7 host.
• 2026-07-31 Security researcher Kevin Beaumont (DoublePulsar) publicly discloses the compromise, noting he observed suspicious activity for longer than Adform's stated detection window.
• 2026-08-01 BleepingComputer, The Hacker News, cybersecuritynews.com, and GridinSoft publish corroborating technical coverage of the incident.
• 2026-08-02 HECAVEX publishes byte-level analysis of the captured malicious sample, identifying multiple payload variants, the XOR obfuscation scheme, and the hosting infrastructure for the C2 endpoint.
• 2026-08-03 Jamaica's national CIRT issues a public advisory summarizing IOCs and remediation guidance for organizations that embedded the Adform script.

Sources cited

• Adform Advertising Script Poisoned to Swap Cryptocurrency Wallet Addresses Across Customer Sites cirt.gov.jm · Advisory · 2026-08-03
• Adform Supply Chain Attack: JavaScript Crypto Clipper Analysis hecavex.com · Research · 2026-08-02
• URLScan.io capture of cached-advanced trackpoint-async.js variant urlscan.io · Research · 2026-07-30
• Adform compromised to serve crypto stealer via supply chain attack doublepulsar.com · Blog · 2026-07-31
• Adform Script Swapped Crypto Wallet Addresses blog.gridinsoft.com · Blog · 2026-08-01
• Online ad firm Adform's script compromised to steal cryptocurrency BleepingComputer · News · 2026-07-31
• Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites The Hacker News · News · 2026-08-01
• Hackers Turned a Trusted Advertising Platform Into a Crypto-Stealer Delivery Network cybersecuritynews.com · News · 2026-08-01

More in supply chain

• Compromised GitHub Accounts Push CI Secret Stealer to Tens of Thousands of Repositories (November 2026 Wave)
• Why SBOMs Are Failing to Stop Supply Chain Attacks: XZ Utils Backdoor (CVE-2024-3094) and Axios npm Compromise (March 2026) as Case Studies
• Software Supply Chain Attacks Weaponizing Trusted Developer Workflows (Shai-Hulud, Miasma, Hades, TeamPCP)
• Active ScreenConnect Attacks Breach MSPs via Run Command, Deploying Rogue ScreenConnect Clients Across Dozens of Organizations
• MCP Server Supply Chain Weaknesses (uvx/npx Unpinned Dependencies) Could Expose API Keys and Administrator Credentials

Previous and next in supply chain

• DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules to Deliver Go RAT with Slack and Arbitrum Sepolia Blockchain C2 Previous report
• Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026) Next report

Further reading

• Axios Supply Chain Attack: Cross-Platform RATs
• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• npm Supply Chain Attacks 2026: 218 Packages