An Adform script was compromised to steal cryptocurrency from the sites that used it

The tracking script of Adform — one of Europe’s largest advertising-technology firms — was compromised to steal cryptocurrency from the sites that loaded it. The sites were not attacked one by one: a third-party vendor they all used was compromised, and the malicious code reached all of them at once. This is the playbook of a client-side supply-chain attack. Below: how it worked and what to take away if you run third-party scripts.

In brief

• Malicious code was injected into trackpoint-async.js, Adform’s tracking script served from s2.adform.net.
• The code monitored the clipboard and rewrote wallet addresses for Bitcoin, Ethereum and TRON — copied or displayed on the page — with attacker-controlled addresses.
• It talked to attacker infrastructure at 84.32.102[.]230:7744, sending the victim’s IP, referring site and URL path.
• No persistence: it installed nothing and ran only while the page was open.
• Found by researcher Kevin Beaumont; undetected by VirusTotal antivirus engines.
• Adform confirmed and removed the code on 27 July 2026; the oldest sample dates to 26 July.

How the attack worked

The mechanism is a wallet-drainer delivered through the supply chain:

• Obfuscated payload, appended to the legitimate library. The script looked normal; the malicious code was tacked on, obfuscated, at the end.
• Address swapping. The code rewrote wallet addresses on the page and in the clipboard. If you wanted to send crypto to an address and copied it, you actually pasted the attacker’s — a class of attack where the victim sends the money themselves, to someone else.
• Three networks targeted: Bitcoin, Ethereum and TRON.
• Minimal exfiltration: the victim’s IP, referrer and URL path, sent to 84.32.102[.]230:7744.
• No persistence, no install. Per Adform, the code “was not designed to install software on a user’s device or establish persistence. It operated only while an affected webpage was open.”

The detail that should give pause: the payload was detected by no antivirus engine on VirusTotal. A client-side skimmer does not “infect” the computer — it runs in the browser, on the page you visit, and vanishes when you close the tab. Classic antivirus has nothing to catch.

Impact and discovery

All sites loading the affected Adform technology on 27 July 2026 were exposed. The exact number of compromised sites and the amounts stolen were not disclosed. The attack surfaced thanks to researcher Kevin Beaumont, and an Archive.org snapshot from 26 July preserved the evidence of the oldest malicious sample.

The advice given: if you visited sites loading Adform on 27 July, clear your browser cookies and check your crypto wallets for unauthorized transactions. No known threat group was attributed.

What to take away

• A third-party script is your attack surface. Analytics, ads, chat widgets, tag managers, CDN fonts — each runs with full privileges in your page. If the vendor is compromised, the attacker’s code runs on your domain, in front of your users.
• Antivirus does not cover you here. Client-side skimmers run in the browser and never touch the disk. The defense is not at the endpoint — it is in what you load into the page.
• The layers that matter: minimize third-party scripts, use Subresource Integrity (SRI) so a modified script stops loading, set a strict Content-Security-Policy that limits where code can run, and self-host what you can.
• Inventory what is on your site. You cannot protect what you do not know you load. A periodic audit of third-party scripts and security headers finds the door before an attacker does.

Our recommendations

If you run a site or platform that loads external code, here is where we would start:

• Client-side surface audit. We inventory the third-party scripts you load, check whether you have Subresource Integrity and a Content-Security-Policy that actually limits where code can run, and show you what could be self-hosted. Part of the security audit.
• Security testing. A penetration test checks not just your application but also what it loads into the visitor’s browser and how delivery is configured — exactly the layer antivirus does not cover.
• Continuous security. A third-party vendor can be compromised at any time; monitoring and periodic review catch the change when it happens, not months later.

Want a clear picture of what your site loads and how exposed you are? Get in touch and we start with an audit.