Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites Contact/Tip Us Reach out to get featured—contact us to send your exclusive story idea, research, hacks, or ask us a question or leave a comment/feedback! Follow Us On Social Media RSS Feeds Email Alerts Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites Swati Khandelwal Aug 01, 2026 Web Security / Supply Chain Attack Attackers modified a JavaScript file served by advertising technology company Adform , turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to authorities. Anyone who visited a site carrying the affected script on July 27 and copied a Bitcoin, Ethereum, or Tron address may have pasted a different address inserted by the malicious code instead. Adform is telling people to clear their browser cache because the altered file may remain cached after the fix, and to check any wallet address before sending funds. Adform says the code was not designed to install software or establish persistence and operated only while an affected page remained open. The captured sample also rewrites addresses entered directly into form fields, so clipboard copying was not the only path to replacement. The public timeline is unresolved. Adform’s notice identifies July 27 as the affected date; Kevin Beaumont says he saw malicious activity via Adform over the past week. The compromised resource is trackpoint-async.js, served from s2.adform[.]net. Adform’s implementation documentation says the tracking code can run on one page, several sections, or unconditionally across an entire website. Compromising that shared resource gave the attackers a route into unrelated downstream sites without having to breach each one separately. The shared deployment path makes this a supply-chain compromise. While the affected page remained open, one altered address at the point of payment could redirect a transfer. Beaumont, an independent security researcher, disclosed the compromise and wrote, “Even if you notice the address is wrong and recopy the wallet, it keeps replacing it.” Beaumont reported that the file and its associated URLs, domains, and IP addresses returned no detections on VirusTotal at the time. Max Maass published a captured copy of the script on July 27. The captured sample contains two malicious blocks appended to the legitimate library. Their replacement strings are obfuscated with a six-byte XOR key. The first watches for the copy event, tries to read the clipboard every four seconds, and to replace matching addresses. It also attempts an HTTP request to 84.32.102[.]230:7744 on page load that includes the hostname and path of the page the visitor is on. The second block walks the document’s text nodes, rewrites values in input, textarea, and contenteditable elements, and restores the cursor position after a rewrite. It hooks the value setter on input and textarea elements, so programmatic writes are rewritten in transit. It also intercepts copy, cut, paste, and input events. Both blocks contain hardcoded replacement strings for Bitcoin, Ethereum, and Tron address patterns, and Beaumont said the addresses appeared to vary. Adform says it found no evidence that the code transmitted visitors’ IP addresses or information about websites they visited. It added in its incident notice that “Technical analysis indicates that such transmission may have been possible.” The first payload’s request is built to send a page hostname and path to the outside server; whether it reached the operator is not established by the sample. Most of the scope is still missing: how many websites carried the file, how many visitors were exposed, how the attackers reached Adform’s deployment path, and whether any funds were diverted. The duration gap also prevents a defensible exposure estimate because Adform’s July 27 affected-date statement and Beaumont’s longer observation remain unreconciled. Adform’s public incident notice lists no indicators of compromise. Adform’s 2025 annual report says the company had roughly 1,800 customers, enabled 1.5 billion ads to be displayed daily, and served or transacted ads in more than 180 countries during 2025. Those figures describe the platform, not this incident. A more useful number is how many page loads actually received the altered resource, a count Adform has not published. Adform has not publicly identified the attacker. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post. SHARE Tweet Share Share Share Share on Facebook Share on Twitter Share on Linkedin Share on Reddit Share on Hacker News Share on Email Share on WhatsApp Share on Facebook Messenger Share on Telegram SHARE Advertising , browser security , cryptocurrency , Cyber Attack , Incident response , JavaScript , Malware , Supply Chain Attack , Third-Party Risk , Web Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders Cybersecurity Webinars Risk in AI-Generated Code How to Secure AI Code Before It Reaches Production Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale. Register Build AI Securely How to Secure AI-Built Software at Machine Speed Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed. Register ⚡ Latest News Cybersecurity Resources 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Burp, sqlmap, SSRF, XXE, SSTI: Web Exploitation, Hands-On 35 labs plus a live CTF take you from recon to remote code execution. GWAPT prep, SANS CDI in D.C. SANS AI Cybersecurity Summit Returns This November Learn how practitioners are applying AI to today’s cybersecurity challenges. Expert Insights Articles Videos A Look Inside Lasso’s AI Security Platform July 27, 2026 Read ➝ Claude Runs Across Six Surfaces in Your Company. Your Security Team Sees One. July 27, 2026 Read ➝ How to Make Social Engineering Unprofitable July 22, 2026 Read ➝ The New Insider Has No Pulse: Securing Privilege When the Actor Is an AI Agent July 20, 2026 Read ➝ Get the Latest News in Your Inbox Get the latest news, expert insights, exclusive resources, and strategies from industry leaders, all for free. Email
Menu
