Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites

Summary

Attackers compromised Adform's JavaScript, turning a legitimate script into a tool that rewrites cryptocurrency wallet addresses in real-time for users visiting affected websites. The malicious code could alter Bitcoin, Ethereum, and Tron addresses copied from or entered into web forms, potentially redirecting funds. Adform detected the issue, removed the malicious code, and advised customers to clear browser caches, while the full scope and impact remain under investigation.

Full text

Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites Swati KhandelwalAug 01, 2026Web Security / Supply Chain Attack Attackers modified a JavaScript file served by advertising technology company Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to authorities. Anyone who visited a site carrying the affected script on July 27 and copied a Bitcoin, Ethereum, or Tron address may have pasted a different address inserted by the malicious code instead. Adform is telling people to clear their browser cache because the altered file may remain cached after the fix, and to check any wallet address before sending funds. Adform says the code was not designed to install software or establish persistence and operated only while an affected page remained open. The captured sample also rewrites addresses entered directly into form fields, so clipboard copying was not the only path to replacement. The public timeline is unresolved. Adform's notice identifies July 27 as the affected date; Kevin Beaumont says he saw malicious activity via Adform over the past week. The compromised resource is trackpoint-async.js, served from s2.adform[.]net. Adform's implementation documentation says the tracking code can run on one page, several sections, or unconditionally across an entire website. Compromising that shared resource gave the attackers a route into unrelated downstream sites without having to breach each one separately. The shared deployment path makes this a supply-chain compromise. While the affected page remained open, one altered address at the point of payment could redirect a transfer. Beaumont, an independent security researcher, disclosed the compromise and wrote, "Even if you notice the address is wrong and recopy the wallet, it keeps replacing it." Beaumont reported that the file and its associated URLs, domains, and IP addresses returned no detections on VirusTotal at the time. Max Maass published a captured copy of the script on July 27. The captured sample contains two malicious blocks appended to the legitimate library. Their replacement strings are obfuscated with a six-byte XOR key. The first watches for the copy event, tries to read the clipboard every four seconds, and to replace matching addresses. It also attempts an HTTP request to 84.32.102[.]230:7744 on page load that includes the hostname and path of the page the visitor is on. The second block walks the document's text nodes, rewrites values in input, textarea, and contenteditable elements, and restores the cursor position after a rewrite. It hooks the value setter on input and textarea elements, so programmatic writes are rewritten in transit. It also intercepts copy, cut, paste, and input events. Both blocks contain hardcoded replacement strings for Bitcoin, Ethereum, and Tron address patterns, and Beaumont said the addresses appeared to vary. Adform says it found no evidence that the code transmitted visitors' IP addresses or information about websites they visited. It added in its incident notice that "Technical analysis indicates that such transmission may have been possible." The first payload's request is built to send a page hostname and path to the outside server; whether it reached the operator is not established by the sample. Most of the scope is still missing: how many websites carried the file, how many visitors were exposed, how the attackers reached Adform's deployment path, and whether any funds were diverted. The duration gap also prevents a defensible exposure estimate because Adform's July 27 affected-date statement and Beaumont's longer observation remain unreconciled. Adform's public incident notice lists no indicators of compromise. Adform's 2025 annual report says the company had roughly 1,800 customers, enabled 1.5 billion ads to be displayed daily, and served or transacted ads in more than 180 countries during 2025. Those figures describe the platform, not this incident. A more useful number is how many page loads actually received the altered resource, a count Adform has not published. Adform has not publicly identified the attacker. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Advertising, browser security, cryptocurrency, Cyber Attack, Incident response, JavaScript, Malware, Supply Chain Attack, Third-Party Risk, Web Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders

Indicators of Compromise

• domain — s2.adform.net
• ip — 84.32.102.230
• malware — XOR obfuscated malicious JavaScript

Entities