Adform Ad Platform Hit by Supply-Chain Attack, Delivering Crypto-Stealing Malware Adform, one of Europe’s largest adtech firms, fell victim to a supply-chain attack that injected cryptocurrency-stealing scripts into websites using its advertising platform. Security researcher Kevin Beaumont discovered the malicious activity, which originated from trackpoint-async.js Adform’s JavaScript tracking script served from s2.adform.net embedded across client websites. The trojanized script monitored users’ clipboards in real time, replacing copied Bitcoin, Ethereum, or TRON wallet addresses with attacker-controlled ones to divert cryptocurrency payments. Additionally, the malware could rewrite wallet addresses displayed on web pages, ensuring victims unknowingly sent funds to the threat actor. The script also exfiltrated victims’ IP addresses, referring websites, and URL paths to a command-and-control server at 84.32.102[.]230:7744. Despite its malicious functionality, the script evaded detection by antivirus engines on VirusTotal, appearing clean at the time of analysis. Beaumont noted the attack had been active for at least a week before discovery, with the earliest confirmed sample dating to July 26. Adform confirmed detecting the threat on July 27, removing the malicious code and implementing additional security measures. The company stated the script did not install persistent malware or execute beyond the affected webpage’s session. While services are now deemed safe, Adform advised users who visited impacted sites on July 27 to clear browser cookies. The firm has notified affected clients and continues its investigation. Analysis of archived samples revealed the malicious payload was appended in obfuscated form to Adform’s legitimate tracking library, containing functions to hijack clipboard content and alter on-page wallet addresses. The incident underscores the risks of supply-chain attacks in digital advertising, where compromised third-party scripts can silently compromise end-user devices.