Adform Supply-Chain Attack Compromises Cryptocurrency Wallets

www.bleepingcomputer.com

Adform Supply-Chain Attack Compromises Cryptocurrency Wallets

First seen 4 Aug 2026, 02:19 UTC • •67.5

Article Content

1 / 7

Browse articles

ThreatCluster •August 4, 2026 at 23:54 UTC

•Adform's ad platform was compromised, injecting scripts that stole cryptocurrency wallet addresses.
•The attack affected users visiting sites using Adform's technology on July 27, 2026.
•Users are advised to clear browser cookies to eliminate the malicious code.

Adform, a major online advertising firm, suffered a supply-chain attack that injected scripts into its ad platform, leading to the theft of cryptocurrency. The malicious JavaScript, 'trackpoint-async.js', monitored users' clipboards for Bitcoin, Ethereum, and TRON wallet addresses, replacing legitimate addresses with those controlled by an attacker. Security researcher Kevin Beaumont discovered the issue, which affected users visiting websites using Adform's technology on July 27, 2026. Adform confirmed the incident, removed the malicious code, and is conducting an ongoing investigation. Users are advised to clear their browser cookies to mitigate the impact. The attack did not install persistent malware but compromised devices while affected web pages were open. Adform has communicated with affected clients regarding the incident and recommended actions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 69d ago How this analysis works

Timeline

2026-07-27

Malicious code detected in Adform's tracking script

Adform confirmed a supply-chain attack that injected scripts altering cryptocurrency wallet addresses.

BleepingComputer

2026-08-03

Scworld reports on Adform incident

Scworld published a brief summarizing the attack and its impact on cryptocurrency transactions.

2026-08-04

BleepingComputer publishes detailed analysis

BleepingComputer provided an in-depth report on the supply-chain attack and its implications for users.

BleepingComputer

More articles in this cluster (6)

Threat Graph

8 entities, 7 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Malware
Supply Chain Attack
T1027 - Obfuscated Files Or Information
T1115 - Clipboard Data
T1195 - Supply Chain Compromise

Organization (1)

Adform

Weakness (2)

CWE-200 - Exposure of Sensitive Information
CWE-94 - Code Injection

Relationships

Malware related to Supply Chain Attack
Malware related to Adform
Malware related to CWE-200 - Exposure of Sensitive Information
Malware related to CWE-94 - Code Injection
Malware related to T1027 - Obfuscated Files Or Information
Malware related to T1115 - Clipboard Data
Malware related to T1195 - Supply Chain Compromise

Following this threat?

Track Adform in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…