# Adform Ad-Tech Platform Compromised: Trojanized Tracking Script Serves Crypto Clipboard Stealer via Supply-Chain Attack

> Adform's widely-embedded JavaScript tracking script trackpoint-async.js, served from s2.adform.net, was trojanized between 2026-07-26 and 2026-07-27 to continuously monitor visitor clipboards and page content for Bitcoin, Ethereum, and TRON wallet addresses and silently replace them with attacker-controlled addresses, while exfiltrating the visiting hostname and URL path to an external server. Discovered by security researcher Kevin Beaumont (DoublePulsar) and disclosed 2026-07-31; Adform detected and removed the malicious code on 2026-07-27, reporting no evidence of installed persistence.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2656
- **ID:** TL-2026-2656
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Adform, an advertising-technology company whose demand-side-platform tag is embedded on an estimated ~14,000 businesses' websites across 180+ countries, had its trackpoint-async.js tracking script trojanized. The legitimate 82,727-byte library had a 6,945-byte malicious suffix appended containing two functional blocks, per byte-level analysis published by independent researcher HECAVEX (corroborating Max Maass's public sample capture): an early block that polled the clipboard on an interval and reported page telemetry over plaintext HTTP, and a more advanced block that additionally walked the rendered DOM with a TreeWalker to rewrite wallet-address strings in text nodes, <input>/<textarea>/contenteditable elements, and hooked the value-setter and copy/cut/paste/input events so that both user-pasted and programmatically-written values were intercepted and replaced while the cursor position was preserved to avoid alerting the visitor.

The replacement logic matched common Bitcoin, Ethereum, and TRON address formats and substituted attacker-controlled strings obfuscated behind a six-byte XOR key. The captured samples show at least three distinct variants of increasing capability, one of which contained a malformed (checksum-invalid) TRON replacement string, suggesting active iteration by the attacker during the exposure window. A hardcoded request to 84.32.102.230:7744 transmitted the visiting page's hostname and URL path on load; the endpoint used plaintext HTTP on a non-standard port, meaning the request was blocked by browser mixed-content policy on any embedding page served over HTTPS. Adform stated it found no evidence of successful data transmission or installed persistent software, and that the code stopped operating once the affected page was closed.

The oldest known evidence is an Archive.org snapshot capturing the malicious code at 2026-07-26 23:29:03 GMT. Adform detected the anomalous activity and removed the malicious code on 2026-07-27, notifying affected clients and reporting the incident to authorities. Kevin Beaumont publicly disclosed the compromise on 2026-07-31, noting he had observed suspicious activity for longer than Adform's stated detection window (a discrepancy that remains unresolved). Independent verification via URLScan.io shows the poisoned script (matching the most advanced payload hash) was also served from a secondary/mirrored hostname (s1.matas.se) using the same script path, indicating exposure was not limited to the primary s2.adform.net host alone. The captured sample ran undetected by every VirusTotal antivirus engine at time of analysis, consistent with browser-only, non-persistent JavaScript payloads generally evading endpoint-focused detection tooling. No threat actor has been publicly attributed, and open questions remain around the full list of affected websites, total visitor exposure, the initial compromise vector into Adform's script pipeline, and whether any cryptocurrency was actually diverted.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1659 Content Injection
- T1059.007 JavaScript
- T1027 Obfuscated Files or Information
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1657 Financial Theft

## Sources

- [Adform compromised to serve crypto stealer via supply chain attack](https://doublepulsar.com/adform-compromised-to-serve-crypto-stealer-via-supply-chain-attack-2f1ec024f33e)
- [Online ad firm Adform's script compromised to steal cryptocurrency](https://www.bleepingcomputer.com/news/security/online-ad-firm-adforms-script-compromised-to-steal-cryptocurrency/)
- [Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites](https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html)
- [Hackers Turned a Trusted Advertising Platform Into a Crypto-Stealer Delivery Network](https://cybersecuritynews.com/adform-advertising-platform-compromised/)
- [Adform Supply Chain Attack: JavaScript Crypto Clipper Analysis](https://hecavex.com/en/research/adform-supply-chain-crypto-clipper/)
- [Adform Advertising Script Poisoned to Swap Cryptocurrency Wallet Addresses Across Customer Sites](https://www.cirt.gov.jm/advisory/adform-advertising-script-poisoned-swap-cryptocurrency-wallet-addresses-across-customer)
- [Adform Script Swapped Crypto Wallet Addresses](https://blog.gridinsoft.com/adform-script-crypto-wallet-address-swap/)
- [URLScan.io capture of cached-advanced trackpoint-async.js variant](https://urlscan.io/result/019fb249-00f3-713f-910a-bdeaa0747b66/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2656