European adtech giant Adform has confirmed a supply-chain attack in which its JavaScript tracking library was modified to steal cryptocurrency from visitors of client websites. The malicious code targeted clipboard contents, swapping copied wallet addresses for ones controlled by the attacker.
Adform operates a full-stack advertising platform used across Europe, including demand-side and supply-side platforms, ad servers, and management tools. Its tracking script, trackpoint-async.js, is served from s2.adform.net and embedded on every website that uses the Adform platform, giving the compromise broad reach.
Security researcher Kevin Beaumont discovered the malicious activity and found that the trojanized script continuously monitored the clipboard of site visitors. When it detected a Bitcoin, Ethereum, or TRON wallet address, it silently overwrote it with an attacker-controlled address, redirecting any subsequent cryptocurrency payment. The malware could also rewrite wallet addresses displayed directly on web pages, not just clipboard content.
Beaumont also identified other Adform-hosted scripts communicating with an external server at 84.32.102.230:7744, transmitting victims’ IP addresses, referring websites, and URL paths. Notably, the malicious script evaded detection entirely, showing a clean result when scanned through VirusTotal.
BleepingComputer independently analyzed an archived sample and confirmed a self-executing, obfuscated payload had been appended to the legitimate Adform library. The function within it matched and replaced any string resembling a crypto wallet address format. The earliest known malicious sample dates to an Archive.org snapshot from July 26, suggesting the compromise ran undetected for roughly a week.
Adform’s Response
Adform confirmed it detected suspicious activity on July 27 and identified a cybersecurity threat. The company says it removed the malicious code and took additional steps to protect website visitors, clients, and its platform. According to Adform, the code was not designed to install software or establish persistence on user devices, operating only while an affected webpage remained open.
Adform states its services are now safe to use, though its investigation continues. Anyone who visited a website embedding the affected Adform technology on July 27, 2026 may be impacted, and the company recommends clearing browser cookies to remove any remaining malicious code. Adform says it has notified affected clients directly with guidance on recommended actions.
Security teams that rely on third-party ad or tracking scripts should treat this incident as a reminder to monitor outbound script behavior and clipboard access on client-facing sites, since traditional antivirus scanning failed to flag the malicious code.