Attackers modified a JavaScript file served by advertising technology company Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses.
Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to authorities.
Anyone who visited a site carrying the affected script on July 27 and copied a Bitcoin, Ethereum, or Tron address may have pasted a different address inserted by the malicious code instead.
Adform is telling people to clear their browser cache because the altered file may remain cached after the fix, and to check any wallet address before sending funds.
Adform says the code was not designed to install software or establish persistence and operated only while an affected page remained open. The captured sample also rewrites addresses entered directly into form fields, so clipboard copying was not the only path to replacement.
The public timeline is unresolved. Adform’s notice identifies July 27 as the affected date; Kevin Beaumont says he saw malicious activity via Adform over the past week.
The compromised resource is trackpoint-async.js, served from s2.adform[.]net. Adform’s implementation documentation says the tracking code can run on one page, several sections, or unconditionally across an entire website. Compromising that shared resource gave the attackers a route into unrelated downstream sites without having to breach each one separately. The shared deployment path makes this a supply-chain compromise.
While the affected page remained open, one altered address at the point of payment could redirect a transfer.
Beaumont, an independent security researcher, disclosed the compromise and wrote, “Even if you notice the address is wrong and recopy the wallet, it keeps replacing it.” Beaumont reported that the file and its associated URLs, domains, and IP addresses returned no detections on VirusTotal at the time. Max Maass published a captured copy of the script on July 27.
The captured sample contains two malicious blocks appended to the legitimate library. Their replacement strings are obfuscated with a six-byte XOR key. The first watches for the copy event, tries to read the clipboard every four seconds, and to replace matching addresses.
It also attempts an HTTP request to 84.32.102[.]230:7744 on page load that includes the hostname and path of the page the visitor is on.
The second block walks the document’s text nodes, rewrites values in input, textarea, and contenteditable elements, and restores the cursor position after a rewrite. It hooks the value setter on input and textarea elements, so programmatic writes are rewritten in transit.
It also intercepts copy, cut, paste, and input events. Both blocks contain hardcoded replacement strings for Bitcoin, Ethereum, and Tron address patterns, and Beaumont said the addresses appeared to vary.
Adform says it found no evidence that the code transmitted visitors’ IP addresses or information about websites they visited. It added in its incident notice that “Technical analysis indicates that such transmission may have been possible.” The first payload’s request is built to send a page hostname and path to the outside server; whether it reached the operator is not established by the sample.
Most of the scope is still missing: how many websites carried the file, how many visitors were exposed, how the attackers reached Adform’s deployment path, and whether any funds were diverted. The duration gap also prevents a defensible exposure estimate because Adform’s July 27 affected-date statement and Beaumont’s longer observation remain unreconciled. Adform’s public incident notice lists no indicators of compromise.
Adform’s 2025 annual report says the company had roughly 1,800 customers, enabled 1.5 billion ads to be displayed daily, and served or transacted ads in more than 180 countries during 2025.
Those figures describe the platform, not this incident. A more useful number is how many page loads actually received the altered resource, a count Adform has not published. Adform has not publicly identified the attacker.
