Loading story…
Adform suffered a supply-chain compromise after attackers trojanized the hosted JavaScript file trackpoint-async.js served from s2.adform.net/banners/scripts/st/trackpoint-async.js, causing websites that embedded the ad platform’s technology to deliver a cryptocurrency-stealing payload to visitors. The injected, obfuscated code monitored clipboard contents every few seconds for Bitcoin, Ethereum, and TRON wallet addresses, then replaced matching addresses with attacker-controlled wallets; reporting also indicates it could rewrite wallet addresses displayed directly on web pages to divert payments.
Security researcher Kevin Beaumont linked the malicious script to communications with attacker-controlled server 84.32.102[.]230:7744, which received victim IP addresses, referring websites, and URL path data. Adform said it detected suspicious activity on July 27, removed the malicious code, and notified affected customers, while external reporting suggests the compromise may have been active for roughly a week and that the appended payload initially evaded antivirus detection, with related file hashes appearing clean on VirusTotal.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
Adform stated that individuals who visited websites embedding the affected Adform technology on July 27, 2026 were impacted. It recommended those users clear browser cookies because the malicious code operated only while an affected webpage was open.
Adform said it reported the supply-chain compromise involving its trojanized tracking script to authorities after detecting and removing the malicious code. The company also notified affected clients and issued user guidance, but the report to authorities is the distinct new development.
Adform said it detected suspicious activity on July 27, discovered the cybersecurity threat, and removed the malicious code from its systems. The company also said it took additional protective measures and notified affected clients with recommended actions.
Reporting says an archived sample from July 26 showed the malicious payload appended in obfuscated form to the legitimate Adform tracking library. Analysis confirmed the injected code was being served from Adform infrastructure.
Technical analysis of the captured Adform sample showed two malicious code blocks appended to the legitimate library, with replacement strings obfuscated using a six-byte XOR key. Beyond clipboard hijacking, the malware also rewrote cryptocurrency wallet addresses entered directly into textarea, contenteditable, and input fields while preserving cursor position.
Kevin Beaumont documented that Adform-hosted scripts were beaconing to attacker-controlled server 84.32.102.230:7744 with victim IP address, referring website, and URL path data. During his write-up, he observed the malicious code appearing to disappear from Adform-served content.
Adform’s hosted JavaScript tracking library, trackpoint-async.js on s2.adform.net, was trojanized in a supply-chain compromise. The injected payload monitored clipboard contents for Bitcoin, Ethereum, and TRON wallet addresses and replaced them with attacker-controlled addresses; reporting says the activity may have been ongoing for about a week.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecysecurity.news
Open sourceteiss.co.uk
Open sourcecyberveille.ch
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcesite.adform.com
Open sourcedoublepulsar.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos identified a months-long **ClickFix** cryptocurrency-theft campaign that tricks users into injecting malicious JavaScript into Chrome or installing it through Tampermonkey. Lures impersonate leaked reports of cryptocurrency-exchange API flaws and promise SwapZone or SimpleSwap trading bonuses. The scripts use Google Sheets and the Google Visualization API for command-and-control, hiding second-stage retrieval within trusted `docs.google.com` traffic, then replace cryptocurrency deposit addresses in webpages, intercepted responses, and the clipboard. Talos linked 49 Bitcoin wallets to the operation; 24 active wallets received 0.159 BTC, roughly $10,000 in early August 2026. ClickFix techniques continue to enable broader malware delivery as well as browser-based theft. A blocked July 2026 intrusion used phishing to induce in-memory PowerShell execution, followed by a loader, process injection into `svchost.exe` or `explorer.exe`, and deployment of PureLogs Stealer targeting browser credentials, cookies, banking data, and cryptocurrency wallets. Earlier activity tracked by Proofpoint showed ClearFake and TA571 using fake browser or certificate warnings and malicious clipboard content to persuade victims to manually run PowerShell, delivering stealers, RATs, loaders, and cryptominers. Organizations should treat unexpected browser verification prompts and copy-paste instructions as high-risk, while monitoring for browser script injection, anomalous Google-hosted script retrieval, and credential or wallet-address manipulation.
Sep 9, 2026
A threat actor impersonated a CoinDesk marketing executive in X direct messages, using post-Black Hat and DEFCON cryptocurrency-conference lures to target security researchers. The messages linked to legitimate Google Docs containing container-bound Google Apps Script that profiled visitors and sent their IP address, geolocation, browser details, and cryptocurrency-wallet-extension data to the operator through Telegram. The campaign routed victims to operating-system-specific malware: macOS users received a variant of the AMOS infostealer, while Windows users were served an encoded PowerShell loader chain and installers signed with three stolen or fraudulently issued certificates. Recovered Windows components included a malicious NetSupport Manager deployment, a persistent rogue local certificate authority capable of TLS interception, and a Ledger-wallet-focused implant. Russian-language comments and C2 artifacts indicate the operator may be Russian-speaking, but no threat group has been attributed.
Sep 14, 2026
Researchers reported an active **Silent Swap** campaign that distributes a fake **"Google Notes"** browser extension to steal cryptocurrency by replacing copied wallet addresses with attacker-controlled ones during transactions. The operation uses unsigned **.NET** and **Golang** installers to silently sideload the malicious extension into Chromium-based browsers including **Chrome, Edge, Brave, and Opera**, where it monitors clipboard activity and browser input for wallet strings across multiple blockchains and swaps them in real time. The malware reportedly abuses Chromium trust mechanisms by altering **Secure Preferences** and related settings files, recalculating integrity values so the extension appears legitimately installed without user approval. Researchers said the campaign also uses **EtherHiding**-style blockchain-based command-and-control, querying a smart contract through public RPC infrastructure to resolve active C2 domains such as `devops-offensive[.]cc` and `Zebregts[.]com`, complicating detection and takedown. The activity has been linked to the **CountLoader** threat actor, with infections observed globally and a heavier concentration in **India**, while dynamic per-victim wallet mapping and published hashes, domains, payload URLs, and Bitcoin wallet indicators suggest a broad effort to monetize consumer cryptocurrency transactions.
Jul 2, 2026