Threat video1:00
Adform Script Crypto Clipper: Detection & IOCs
A trojanized Adform trackpoint-async.js swaps visitors' crypto wallet addresses via the clipboard. 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for Adform Script Crypto Clipper: Detection & IOCs →
Chapters
- 0:00The hookAbout a week before detection.
- 0:04The storyAdform's tracking script was modified.
- 0:11Attack pathAttackers appended two blocks.
- 0:24AttributionNo threat actor is attributed.
- 0:29Indicators of compromise6 indicators to hunt: 1 IP, 4 URLs and 1 file name.
- 0:36MITRE ATT&CK techniques7 ATT&CK techniques, from initial access to impact.
- 0:41Remediation5 steps now: Identify every page that loaded trackpoint-async.js or other Adform-hosted scripts.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About a week before detection.
0:05Adform's tracking script was modified.
0:07Wallet addresses pointed to attackers.
0:11Attackers appended two blocks.
0:13The clipboard is polled every four seconds.
0:16Form fields rewritten too.
0:18Visual checks won't catch it.
0:20Adform removed the code.
0:25No threat actor is attributed. Confidence: low.
0:296 indicators to hunt: 1 IP, 4 URLs and 1 file name.
0:367 ATT&CK techniques, from initial access to impact.
0:415 steps now: Identify every page that loaded trackpoint-async.js or other Adform-hosted scripts.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.