Adform Supply Chain Attack Hijacks Crypto Wallets via Ad Script

Online advertising firm Adform recently suffered a supply-chain attack that turned its legitimate delivery infrastructure into a vector for cryptocurrency theft. The breach allowed attackers to inject malicious code into a script served to thousands of websites, targeting users as they attempted to transfer digital assets.

According to reports from BleepingComputer and security researcher Kevin Beaumont, the compromise centered on the script `trackpoint-async.js`, hosted at `s2.adform.net`. Once loaded in a visitor's browser, the malware monitored the user's clipboard every three seconds, specifically searching for Bitcoin, Ethereum, and TRON wallet addresses. If a matching address was found, the script automatically replaced it with one controlled by the attacker.

To ensure the theft succeeded, the malware repeatedly swapped the address every few seconds, preventing users from simply recopying the original intended destination. Furthermore, the attack could rewrite wallet addresses directly on the web page screen to deceive users into believing they were sending funds to the correct recipient. Security analysis identified the attacker's beacon server as 84.32.102.230 on port 7744.

The Vulnerability of Third-Party Scripts

Adform provides a JavaScript embed that websites use to manage advertising delivery. Because these scripts are designed to be trusted and loaded across a vast array of diverse domains, they provide a high-leverage entry point for attackers. By compromising the infrastructure that serves the script, the threat actors were able to distribute malware to downstream websites without the knowledge or consent of the site owners.

Implications for the Ecosystem

This incident underscores the systemic risk posed by third-party JavaScript dependencies in the advertising ecosystem. A single point of failure at a major provider can expose millions of end-users to targeted financial theft. The use of clipboard hijacking is particularly dangerous because it bypasses standard visual verification; if a user does not manually double-check every character of an address at the exact moment of transaction, the theft occurs invisibly.

What to Watch

While the specific beacon server and compromised script have been identified, the incident highlights a growing trend of supply-chain attacks targeting the ad-tech stack. Security professionals are advised to monitor for unauthorized changes in third-party script behavior and encourage users to utilize hardware wallets or manual address verification to mitigate the risk of clipboard manipulation.