# Adform Supply-Chain Compromise: trackpoint-async.js Serving Crypto-Wallet Address Stealer

> Adform's JavaScript tracking script trackpoint-async.js, served from s2.adform.net, was modified with obfuscated code that hijacks the clipboard and rewrites Bitcoin, Ethereum and TRON wallet addresses (including addresses on the page and in form fields) to attacker-controlled values. Any site loading the script exposed its visitors; Adform confirmed suspicious activity on 2026-07-27 and removed the code, and its investigation is ongoing.

- **Published:** 2026-11-12T16:10:35Z
- **Last reviewed:** 2026-11-12T16:10:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5869
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5869.png
- **ID:** TL-2026-5869
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (2 shown free below)

## Description

On 2026-07-27 Adform, a European ad-technology vendor, confirmed a cybersecurity incident affecting its technology embedded on customer websites. Independent researcher Kevin Beaumont (DoublePulsar) reported that Adform's tracking library trackpoint-async.js (http://s2.adform.net/banners/scripts/st/trackpoint-async.js) had been modified, and told BleepingComputer the activity had run for roughly a week before detection. The oldest sample BleepingComputer found was an Archive.org snapshot captured 2026-07-26 23:29:03 GMT. Adform's own notice gives 2026-07-27 as the affected date, so the exact start of malicious delivery is unresolved across sources. Max Maass published a captured copy of the script on 2026-07-27.

Per The Hacker News analysis, two malicious blocks were appended to the end of the otherwise legitimate library as a self-executing, obfuscated payload. Block 1 monitors copy events, polls the clipboard every four seconds, swaps strings matching Bitcoin, Ethereum and TRON address formats for attacker-controlled addresses, and on page load sends the page hostname and path to 84.32.102.230 on TCP port 7744. Block 2 walks page text nodes and rewrites wallet-address strings, rewrites values in input, textarea and contenteditable elements (restoring cursor position), hooks the value setter so programmatic writes are rewritten, and intercepts copy, cut, paste and input events. The replacement addresses are XOR-encoded with a six-byte key. Because on-page and form-field values are rewritten, re-copying or visually checking an address on the affected page does not defeat the substitution. BleepingComputer additionally reports that other Adform-hosted malicious scripts exfiltrated the visitor IP address, referring site and URL path to 84.32.102.230:7744.

Adform states that, to its knowledge, the code was not designed to install software or establish persistence and operated only while an affected page was open; it removed the code, notified clients and reported the incident to authorities, and advised visitors to clear browser cache/cookies because the altered file may remain cached. The script was not flagged by any antivirus engine on VirusTotal at the time of Beaumont's scan. No threat actor has been named, how the attackers gained access to Adform's delivery path is unknown, and the number of affected sites, the number of exposed visitors, the attacker wallet addresses, file hashes and any funds diverted have not been published. Adform's 2025 annual report cites about 1,800 customers, but that describes the platform, not incident scope.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1071.001 Web Protocols
- T1565.002 Transmitted Data Manipulation
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Adform trackpoint-async.js Supply-Chain Clipper — Client Beaconing to 84.32.102.230:7744 (Exploitation)** (`TL-2026-5869-SPL-001`)

Behaviour-first search for the Adform supply-chain compromise (TL-2026-5869). Flags any client whose proxy telemetry shows contact with the exfiltration endpoint 84.32.102.230 / TCP 7744 that the obfuscated payload appended to trackpoint-async.js (served from s2.adform.net) calls on page load, and reports how many loads of the Adform script the same client made. Indicates execution of the injected JavaScript clipboard/wallet-address stealer in the browser (T1195.002, T1059.007).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1059.007, T1041, T1071.001
- **Data sources:** proxy (squid:access / zscaler:nss:web / bluecoat:proxysg:access:kv), defender_for_endpoint DeviceNetworkEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype IN ("squid:access","zscaler:nss:web","bluecoat:proxysg:access:kv") earliest=-24h (url="*s2.adform.net/banners/scripts/st/trackpoint-async.js*" OR dest_ip="84.32.102.230" OR url="*84.32.102.230:7744*")
| eval adform_load=if(like(url,"%s2.adform.net/banners/scripts/st/trackpoint-async.js%"),1,0), c2_hit=if(dest_ip="84.32.102.230" OR like(url,"%84.32.102.230:7744%"),1,0)
| stats sum(adform_load) AS adform_script_loads sum(c2_hit) AS c2_beacons min(_time) AS first_seen max(_time) AS last_seen values(url) AS urls values(http_referrer) AS referring_pages by src
| where c2_beacons>0
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table src adform_script_loads c2_beacons first_seen last_seen referring_pages urls
```

### Microsoft KQL

```kql
let C2Ip = "84.32.102.230";
let Browsers = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe","iexplore.exe"]);
let AdformLoads = DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has "s2.adform.net"
    | summarize AdformConnections = count(), FirstAdformLoad = min(Timestamp) by DeviceId;
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP == C2Ip or (RemotePort == 7744 and RemoteIPType == "Public" and InitiatingProcessFileName in~ (Browsers))
| join kind=leftouter AdformLoads on DeviceId
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl, AdformConnections, FirstAdformLoad
| order by Timestamp desc
```

### Sigma

```yaml
title: Adform Compromised trackpoint-async.js Exfiltration Beacon via Proxy
id: 3b7a9c1e-5d24-4f08-9a63-1c8e7f2d4b01
status: experimental
description: Detects proxy requests to 84.32.102.230 on TCP 7744, the endpoint contacted on page load by the obfuscated wallet-address stealer appended to Adform's trackpoint-async.js. Correlate with requests to s2.adform.net/banners/scripts/st/trackpoint-async.js from the same client.
references:
    - https://www.bleepingcomputer.com/news/security/online-ad-firm-adforms-script-compromised-to-steal-cryptocurrency/
    - https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html
    - https://gist.github.com/malexmave/8ef5eabc7b6866698f1ea8a811c75b57
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1059.007
    - attack.exfiltration
    - attack.t1041
    - attack.command-and-control
    - attack.t1071.001
logsource:
    category: proxy
detection:
    selection:
        cs-host|startswith: '84.32.102.230'
        c-uri|contains: ':7744'
    condition: selection
falsepositives:
    - Security researchers or analysts deliberately browsing to the IOC
    - Address reassigned to unrelated hosting after the incident
level: high

```

**Known false positives:**

- Security analysts or sandboxes intentionally replaying the sample and visiting the IOC
- Address reassigned to unrelated hosting after the incident

**Tuning notes:** Set the proxy index/sourcetype to your SWG. Uses CIM fields src, url, dest_ip, http_referrer; if your proxy lacks dest_ip rely on the url match. Exclude malware-analysis sandbox subnets. Raise urgency when adform_script_loads>0 for the same client in the 24h before the first beacon.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Clients Loading Adform [indicator] from [indicator] (Exploitation Exposure Inventory) (locked: unlock with TL Creds)
- Non-Browser Application (Electron/WebView) Contacting Adform Clipper Exfil Endpoint (Post-Exploitation) (locked: unlock with TL Creds)
- HTTP Request to Bare-IP Host on TCP/7744 via Web Proxy — Clipper Exfil Pattern (C2) (locked: unlock with TL Creds)
- Adform [indicator] Content Size Drift Indicating Appended Obfuscated Payload (Exploitation) (locked: unlock with TL Creds)
- Multiple Distinct Page Beacons to Adform Clipper Exfil Endpoint — Exposure Scope (Post-Exploitation) (locked: unlock with TL Creds)
- Zeek HTTP to Bare-IP Host on TCP/7744 — Adform Clipper Exfil Channel (C2) (locked: unlock with TL Creds)
- Browser Process Connecting to Adform Clipper Exfil Endpoint [indicator] / TCP 7744 (Post-Exploitation) (locked: unlock with TL Creds)
- Egress to Adform Clipper Exfil Infrastructure [indicator] / TCP 7744 at Network Perimeter (C2 / Exfiltration) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 9)

Defanged, TLP:CLEAR.

- IP address: `84.32.102[.]230`
- URL: `hxxps://pastebin[.]com/mc7psaNF`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Online ad firm Adform's script compromised to steal cryptocurrency (BleepingComputer)](https://www.bleepingcomputer.com/news/security/online-ad-firm-adforms-script-compromised-to-steal-cryptocurrency/)
- [Hackers Poison Adform Script to Swap Crypto Wallet Addresses (The Hacker News)](https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html)
- [Adform 2026 Supply-Chain Attack: Cryptocurrency Theft (Aviatrix Threat Research Center)](https://aviatrix.ai/threat-research-center/adform-2026-supply-chain-attack-cryptocurrency-theft)
- [Adform Delivery Script Compromised: Wallet Addresses Replaced on Clipboard and Screen (dev.to)](https://dev.to/anoymask/adform-delivery-script-compromised-wallet-addresses-replaced-on-clipboard-and-screen-29f8)
- [Adform script compromise shows how trusted web supply chains reach endpoints (Hexnode)](https://www.hexnode.com/threat-watch/adform-script-compromise-shows-how-trusted-web-supply-chains-reach-endpoints/)
- [Captured copy of the malicious trackpoint-async.js published by Max Maass (GitHub gist)](https://gist.github.com/malexmave/8ef5eabc7b6866698f1ea8a811c75b57)
- [Adform advertising platform compromised (Cyber Security News)](https://cybersecuritynews.com/adform-advertising-platform-compromised/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5869