Skip to navigation

Threat reportSupply ChainTL-2026-5869

Adform Supply-Chain Compromise: trackpoint-async.js Serving Crypto-Wallet Address Stealer

highMONITORING

Adform's JavaScript tracking script trackpoint-async.js, served from s2.adform.net, was modified with obfuscated code that hijacks the clipboard and rewrites Bitcoin, Ethereum and TRON wallet addresses (including addresses on the page and in form fields) to attacker-controlled values. Any site loading the script exposed its visitors; Adform confirmed suspicious activity on 2026-07-27 and removed the code, and its investigation is ongoing. First disclosed .

Key facts

IdentifiersTL-2026-5869
Also known asAdform script compromise, Adform crypto clipper
SeverityHIGH
First disclosed
Affected productsAdform Adform tracking/delivery JavaScript (trackpoint-async.js on s2.adform.net)
Weaknesses (CWE)CWE-506, CWE-829
MalwareDoublePulsar, Obfuscated JavaScript crypto clipper (unnamed)
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1027.013 Encrypted/Encoded File, T1059.007 JavaScript, T1071.001 Web Protocols, T1195.002 Compromise Software Supply Chain, T1565.002 Transmitted Data Manipulation, T1657 Financial Theft
MotivationFINANCIAL
Target sectorscryptocurrency, finance, ecommerce, advertising, news - media
Target regionsGlobal, Europe
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5869 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Adform trackpoint-async.js Supply-Chain Clipper — Client Beaconing to 84.32.102.230:7744 (Exploitation)

Behaviour-first search for the Adform supply-chain compromise (TL-2026-5869). Flags any client whose proxy telemetry shows contact with the exfiltration endpoint 84.32.102.230 / TCP 7744 that the obfuscated payload appended to trackpoint-async.js (served from s2.adform.net) calls on page load, and reports how many loads of the Adform script the same client made. Indicates execution of the injected JavaScript clipboard/wallet-address stealer in the browser (T1195.002, T1059.007).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1195.002, T1059.007, T1041, T1071.001
  • Data sources: proxy (squid:access / zscaler:nss:web / bluecoat:proxysg:access:kv), defender_for_endpoint DeviceNetworkEvents
  • Severity: high
  • Confidence: high

Splunk SPL

index=proxy sourcetype IN ("squid:access","zscaler:nss:web","bluecoat:proxysg:access:kv") earliest=-24h (url="*s2.adform.net/banners/scripts/st/trackpoint-async.js*" OR dest_ip="84.32.102.230" OR url="*84.32.102.230:7744*")
| eval adform_load=if(like(url,"%s2.adform.net/banners/scripts/st/trackpoint-async.js%"),1,0), c2_hit=if(dest_ip="84.32.102.230" OR like(url,"%84.32.102.230:7744%"),1,0)
| stats sum(adform_load) AS adform_script_loads sum(c2_hit) AS c2_beacons min(_time) AS first_seen max(_time) AS last_seen values(url) AS urls values(http_referrer) AS referring_pages by src
| where c2_beacons>0
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table src adform_script_loads c2_beacons first_seen last_seen referring_pages urls

Microsoft KQL

let C2Ip = "84.32.102.230";
let Browsers = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe","iexplore.exe"]);
let AdformLoads = DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has "s2.adform.net"
    | summarize AdformConnections = count(), FirstAdformLoad = min(Timestamp) by DeviceId;
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP == C2Ip or (RemotePort == 7744 and RemoteIPType == "Public" and InitiatingProcessFileName in~ (Browsers))
| join kind=leftouter AdformLoads on DeviceId
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl, AdformConnections, FirstAdformLoad
| order by Timestamp desc

Sigma

title: Adform Compromised trackpoint-async.js Exfiltration Beacon via Proxy
id: 3b7a9c1e-5d24-4f08-9a63-1c8e7f2d4b01
status: experimental
description: Detects proxy requests to 84.32.102.230 on TCP 7744, the endpoint contacted on page load by the obfuscated wallet-address stealer appended to Adform's trackpoint-async.js. Correlate with requests to s2.adform.net/banners/scripts/st/trackpoint-async.js from the same client.
references:
    - https://www.bleepingcomputer.com/news/security/online-ad-firm-adforms-script-compromised-to-steal-cryptocurrency/
    - https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html
    - https://gist.github.com/malexmave/8ef5eabc7b6866698f1ea8a811c75b57
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1059.007
    - attack.exfiltration
    - attack.t1041
    - attack.command-and-control
    - attack.t1071.001
logsource:
    category: proxy
detection:
    selection:
        cs-host|startswith: '84.32.102.230'
        c-uri|contains: ':7744'
    condition: selection
falsepositives:
    - Security researchers or analysts deliberately browsing to the IOC
    - Address reassigned to unrelated hosting after the incident
level: high

Known false positives:

  • Security analysts or sandboxes intentionally replaying the sample and visiting the IOC
  • Address reassigned to unrelated hosting after the incident

Tuning notes: Set the proxy index/sourcetype to your SWG. Uses CIM fields src, url, dest_ip, http_referrer; if your proxy lacks dest_ip rely on the url match. Exclude malware-analysis sandbox subnets. Raise urgency when adform_script_loads>0 for the same client in the 24h before the first beacon.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Clients Loading Adform [indicator] from [indicator] (Exploitation Exposure Inventory) · unlock with TL Creds
  • Non-Browser Application (Electron/WebView) Contacting Adform Clipper Exfil Endpoint (Post-Exploitation) · unlock with TL Creds
  • HTTP Request to Bare-IP Host on TCP/7744 via Web Proxy — Clipper Exfil Pattern (C2) · unlock with TL Creds
  • Adform [indicator] Content Size Drift Indicating Appended Obfuscated Payload (Exploitation) · unlock with TL Creds
  • Multiple Distinct Page Beacons to Adform Clipper Exfil Endpoint — Exposure Scope (Post-Exploitation) · unlock with TL Creds
  • Zeek HTTP to Bare-IP Host on TCP/7744 — Adform Clipper Exfil Channel (C2) · unlock with TL Creds
  • Browser Process Connecting to Adform Clipper Exfil Endpoint [indicator] / TCP 7744 (Post-Exploitation) · unlock with TL Creds
  • Egress to Adform Clipper Exfil Infrastructure [indicator] / TCP 7744 at Network Perimeter (C2 / Exfiltration) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5869.

Sample indicators (2 of 9)

  • IP address: 84.32.102[.]230
  • URL: hxxps://pastebin[.]com/mc7psaNF

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

9 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

On 2026-07-27 Adform, a European ad-technology vendor, confirmed a cybersecurity incident affecting its technology embedded on customer websites. Independent researcher Kevin Beaumont (DoublePulsar) reported that Adform's tracking library trackpoint-async.js (http://s2.adform.net/banners/scripts/st/trackpoint-async.js) had been modified, and told BleepingComputer the activity had run for roughly a week before detection. The oldest sample BleepingComputer found was an Archive.org snapshot captured 2026-07-26 23:29:03 GMT. Adform's own notice gives 2026-07-27 as the affected date, so the exact start of malicious delivery is unresolved across sources. Max Maass published a captured copy of the script on 2026-07-27.

Per The Hacker News analysis, two malicious blocks were appended to the end of the otherwise legitimate library as a self-executing, obfuscated payload. Block 1 monitors copy events, polls the clipboard every four seconds, swaps strings matching Bitcoin, Ethereum and TRON address formats for attacker-controlled addresses, and on page load sends the page hostname and path to 84.32.102.230 on TCP port 7744. Block 2 walks page text nodes and rewrites wallet-address strings, rewrites values in input, textarea and contenteditable elements (restoring cursor position), hooks the value setter so programmatic writes are rewritten, and intercepts copy, cut, paste and input events. The replacement addresses are XOR-encoded with a six-byte key. Because on-page and form-field values are rewritten, re-copying or visually checking an address on the affected page does not defeat the substitution. BleepingComputer additionally reports that other Adform-hosted malicious scripts exfiltrated the visitor IP address, referring site and URL path to 84.32.102.230:7744.

Adform states that, to its knowledge, the code was not designed to install software or establish persistence and operated only while an affected page was open; it removed the code, notified clients and reported the incident to authorities, and advised visitors to clear browser cache/cookies because the altered file may remain cached. The script was not flagged by any antivirus engine on VirusTotal at the time of Beaumont's scan. No threat actor has been named, how the attackers gained access to Adform's delivery path is unknown, and the number of affected sites, the number of exposed visitors, the attacker wallet addresses, file hashes and any funds diverted have not been published. Adform's 2025 annual report cites about 1,800 customers, but that describes the platform, not incident scope.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File

Execution

T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols

Initial Access

T1195.002 Compromise Software Supply Chain

Impact

T1565.002 Transmitted Data Manipulation; T1657 Financial Theft

Remediation

Patches

  • No CVE or patch; Adform removed the malicious code from its hosted scripts (2026-07-27)

Immediate actions

  • Identify every page that loaded trackpoint-async.js or other Adform-hosted scripts, particularly around 2026-07-20 to 2026-07-27
  • Block or alert on outbound connections to 84.32.102.230 (TCP/7744)
  • Clear browser, application and CDN caches so the altered script is not served from cache
  • Review transactions and payment-address displays on affected pages for wallet-address substitution; verify addresses via an independent channel
  • Preserve proxy, web, browser and endpoint telemetry for correlation

Workarounds

  • Apply Subresource Integrity where the vendor script is static enough to support it
  • Self-host or proxy and pin vetted copies of critical third-party scripts
  • Temporarily remove Adform tags from payment and wallet-address pages until the vendor investigation concludes

Longer-term hardening

  • Inventory all third-party JavaScript dependencies and assign an owner to each
  • Monitor hosted third-party scripts for unexpected content changes
  • Deploy Content Security Policy with restrictive script-src and connect-src directives
  • Establish rapid vendor-notification and script-removal procedures

Affected and fixed versions

  • Adform — Adform tracking/delivery JavaScript (trackpoint-async.js on s2.adform.net)
    Vulnerable versions: Copies served from s2.adform.net between approximately 2026-07-26 and 2026-07-27 (start date disputed; Beaumont reported about a week of activity)
    Fixed in: Malicious code removed by Adform on or after 2026-07-27

Timeline

  • Oldest known malicious sample of locked-ioc-5: Archive.org snapshot captured 2026-07-26 23:29:03 GMT (per BleepingComputer). Beaumont separately reported about a week of activity, so true start of delivery is unresolved.
  • Max Maass publishes a captured copy of the malicious script as a GitHub gist; Kevin Beaumont's DoublePulsar analysis reports the compromise.
  • Adform confirms suspicious activity/a cybersecurity threat affecting its technology, removes the malicious code, notifies clients and reports to authorities.
  • BleepingComputer publishes its analysis confirming the obfuscated clipboard/on-page wallet replacement payload and exfiltration to locked-ioc-6:7744; no AV engine on VirusTotal flagged the script.
  • The Hacker News publishes a breakdown of the two appended malicious blocks (clipboard polling every 4 seconds, form-field and DOM rewriting, six-byte XOR-encoded replacement strings); Aviatrix and dev.to summaries follow.
  • Hexnode publishes incident-response and third-party-script governance guidance (cache clearing, CSP, SRI); Adform's investigation remains ongoing with no attribution, victim count or loss figures published.

Sources cited

Previous and next in supply chain

Further reading

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats