Adform Supply-Chain Attack Compromises Cryptocurrency Wallets

Adform, a major online advertising firm, suffered a supply-chain attack that injected scripts into its ad platform, leading to the theft of cryptocurrency. The malicious JavaScript, 'trackpoint-async.js', monitored users' clipboards for Bitcoin, Ethereum, and TRON wallet addresses, replacing legitimate addresses with those controlled by an attacker. Security researcher Kevin Beaumont discovered the issue, which affected users visiting websites using Adform's technology on July 27, 2026. Adform confirmed the incident, removed the malicious code, and is conducting an ongoing investigation. Users are advised to clear their browser cookies to mitigate the impact. The attack did not install persistent malware but compromised devices while affected web pages were open. Adform has communicated with affected clients regarding the incident and recommended actions.

Key Points: • Adform's ad platform was compromised, injecting scripts that stole cryptocurrency wallet addresses. • The attack affected users visiting sites using Adform's technology on July 27, 2026. • Users are advised to clear browser cookies to eliminate the malicious code.