- Attackers modified Adform’s JavaScript file to rewrite Bitcoin, Ethereum, and Tron wallet addresses on July 27, 2026.
- The malicious code replaced addresses both via clipboard copy and direct form field entry, and it kept swapping even if users recopied.
- The compromised resource, trackpoint-async.js, turned the ad-tech platform into a supply‑chain vector affecting downstream websites.
- Adform recommends clearing browser caches and verifying wallet addresses before any fund transfer.
On July 27, 2026, attackers compromised Adform’s JavaScript library, turning it into a browser‑side tool that rewrites cryptocurrency wallet addresses on any site carrying the script. The malicious code was served from s2.adform[.]net; Adform detected the incident that same day, removed the code, and notified affected clients.
The altered script appended two obfuscated blocks to the legitimate library, using a six‑byte XOR key to hide replacement strings for Bitcoin, Ethereum, and Tron patterns. Security researcher Kevin Beaumont, who disclosed the compromise, wrote: “Even if you notice the address is wrong and recopy the wallet, it keeps replacing it.” Max Maass published a captured copy of the script on the same day.
The first block watches for the copy event, reads the clipboard every four seconds, and attempts an HTTP request to an outside server containing the page hostname and path. The second block walks document text nodes and intercepts copy, cut, paste, and input events to rewrite addresses in form fields and contenteditable elements. Adform stated in its incident notice that transmission of IP addresses or site information may have been possible, though no evidence of that was found.
Adform said the code did not install software or persist beyond the page session. The company has not disclosed how many sites or visitors were exposed, how attackers gained access, or whether any funds were diverted. It advises users to clear browser caches and double‑check wallet addresses before sending any cryptocurrency.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Shiba Inu Evolves Beyond Memecoin Status with New Ecosystem
- Amazon stock surges 15% on Q2 earnings, AWS revenue up 37%
- Google removes Earth AI feature after fake satellite image backlash
- Moonshot AI Uses 20,000 Nvidia Chips Leased from Alibaba
- Bank of Italy study finds stablecoins no cheaper or faster than traditional remittances
