Adform Ad-Tech Platform Compromised: Trojanized Tracking Script Serves Crypto Clipboard Stealer via Supply-Chain Attack

Adform Ad-Tech Platform Compromised (TL-2026-2656) is a high-severity supply-chain compromise, first published 2026-09-26. It has no confirmed attribution, affects Adform trackpoint-async.js JavaScript tracking/tag script (served via, maps to 7 MITRE ATT&CK techniques (T1027, T1059.007, T1071.001), and is covered by 9 detection rules and 10 indicators of compromise.

Key facts for TL-2026-2656

Threat ID
TL-2026-2656
Severity
HIGH
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-09-26
Last reviewed
2026-09-26
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
advertising, ecommerce, news - media, cryptocurrency, retail, financial services, technology
Target regions
Global
Detection rules
9
Indicators of compromise
10

Malware and tooling in Adform Ad-Tech Platform Compromised

Malware and tooling: DoublePulsar

Adform's widely-embedded JavaScript tracking script trackpoint-async.js, served from s2.adform.net, was trojanized between 2026-07-26 and 2026-07-27 to continuously monitor visitor clipboards and page content for Bitcoin, Ethereum, and TRON wallet addresses and silently replace them with attacker-controlled addresses, while exfiltrating the visiting hostname and URL path to an external server. Discovered by security researcher Kevin Beaumont (DoublePulsar) and disclosed 2026-07-31; Adform detected and removed the malicious code on 2026-07-27, reporting no evidence of installed persistence.

How Adform Ad-Tech Platform Compromised works

Adform, an advertising-technology company whose demand-side-platform tag is embedded on an estimated ~14,000 businesses' websites across 180+ countries, had its trackpoint-async.js tracking script trojanized. The legitimate 82,727-byte library had a 6,945-byte malicious suffix appended containing two functional blocks, per byte-level analysis published by independent researcher HECAVEX (corroborating Max Maass's public sample capture): an early block that polled the clipboard on an interval and reported page telemetry over plaintext HTTP, and a more advanced block that additionally walked the rendered DOM with a TreeWalker to rewrite wallet-address strings in text nodes, <input>/<textarea>/contenteditable elements, and hooked the value-setter and copy/cut/paste/input events so that both user-pasted and programmatically-written values were intercepted and replaced while the cursor position was preserved to avoid alerting the visitor.

The replacement logic matched common Bitcoin, Ethereum, and TRON address formats and substituted attacker-controlled strings obfuscated behind a six-byte XOR key. The captured samples show at least three distinct variants of increasing capability, one of which contained a malformed (checksum-invalid) TRON replacement string, suggesting active iteration by the attacker during the exposure window. A hardcoded request to 84.32.102.230:7744 transmitted the visiting page's hostname and URL path on load; the endpoint used plaintext HTTP on a non-standard port, meaning the request was blocked by browser mixed-content policy on any embedding page served over HTTPS. Adform stated it found no evidence of successful data transmission or installed persistent software, and that the code stopped operating once the affected page was closed.

The oldest known evidence is an Archive.org snapshot capturing the malicious code at 2026-07-26 23:29:03 GMT. Adform detected the anomalous activity and removed the malicious code on 2026-07-27, notifying affected clients and reporting the incident to authorities. Kevin Beaumont publicly disclosed the compromise on 2026-07-31, noting he had observed suspicious activity for longer than Adform's stated detection window (a discrepancy that remains unresolved). Independent verification via URLScan.io shows the poisoned script (matching the most advanced payload hash) was also served from a secondary/mirrored hostname (s1.matas.se) using the same script path, indicating exposure was not limited to the primary s2.adform.net host alone. The captured sample ran undetected by every VirusTotal antivirus engine at time of analysis, consistent with browser-only, non-persistent JavaScript payloads generally evading endpoint-focused detection tooling. No threat actor has been publicly attributed, and open questions remain around the full list of affected websites, total visitor exposure, the initial compromise vector into Adform's script pipeline, and whether any cryptocurrency was actually diverted.

MITRE ATT&CK techniques used in TL-2026-2656

Stealth

T1027 Obfuscated Files or Information

Execution

T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols

Collection

T1119 Automated Collection

Initial Access

T1195.002 Compromise Software Supply Chain; T1659 Content Injection

Impact

T1657 Financial Theft

Affected products and versions in Adform Ad-Tech Platform Compromised

  • Adform — trackpoint-async.js JavaScript tracking/tag script (served via s2.adform.net)
    Vulnerable versions: Script instance served between 2026-07-26T23:29:03Z (earliest known archive snapshot) and remediation on 2026-07-27
    Fixed in: Script instance served by Adform after the 2026-07-27 remediation

Remediation for Adform Ad-Tech Platform Compromised

Patches

  • Adform removed the malicious code from trackpoint-async.js on 2026-07-27; embedding sites need only ensure they are fetching the current, clean script (no local patch is applicable since the compromise was server-side at the vendor)

Immediate actions

  • Block outbound network traffic to 84.32.102.230:7744 at the perimeter/firewall layer
  • Audit all third-party/ad-tech scripts embedded on production websites, including any Adform tags, for supply-chain integrity
  • Clear browser cache on endpoints that visited sites embedding trackpoint-async.js around 2026-07-27
  • Confirm with Adform or affected vendors whether embedded sites served the compromised script and during what window

Workarounds

  • Prefer hardware wallets with independent, on-device address-display confirmation for cryptocurrency transactions
  • Disable or sandbox third-party ad/tag scripts on pages where users handle cryptocurrency addresses

Longer-term hardening

  • Adopt Subresource Integrity (SRI) hashes and Content-Security-Policy script-src allowlisting for all third-party ad/tag scripts
  • Monitor Adform and other ad-tech vendor security advisories for follow-up disclosures
  • Educate users and customers to manually verify cryptocurrency wallet addresses character-by-character rather than trusting pasted clipboard content
  • Review recent cryptocurrency transactions on affected systems for signs of address substitution

Weaknesses (CWE) in Adform Ad-Tech Platform Compromised

CWE-829, CWE-494

Timeline of Adform Ad-Tech Platform Compromised

  • Archive.org captures the trojanized trackpoint-async.js at 23:29:03 GMT, the earliest known snapshot containing the malicious payload appended to the legitimate script.
  • Adform notifies affected clients of the incident and reports the event to authorities.
  • Adform detects the suspicious activity and removes the malicious code from trackpoint-async.js, finding no evidence of persistence beyond the open page.
  • A URLScan.io capture records the most advanced payload variant (SHA-256 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55) served from a mirrored hostname (s1.matas.se) at the same script path, indicating exposure beyond the primary s2.adform.net host.
  • Security researcher Kevin Beaumont (DoublePulsar) publicly discloses the compromise, noting he observed suspicious activity for longer than Adform's stated detection window.
  • BleepingComputer, The Hacker News, cybersecuritynews.com, and GridinSoft publish corroborating technical coverage of the incident.
  • HECAVEX publishes byte-level analysis of the captured malicious sample, identifying multiple payload variants, the XOR obfuscation scheme, and the hosting infrastructure for the C2 endpoint.
  • Jamaica's national CIRT issues a public advisory summarizing IOCs and remediation guidance for organizations that embedded the Adform script.

Sources cited for Adform Ad-Tech Platform Compromised

More in supply chain

Detection coverage for TL-2026-2656

As of 2026-09-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2656 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats