Incident Overview & Chronology

On July 27, 2026, threat actors executed a high-impact supply-chain attack against European advertising technology (adtech) provider Adform. Attackers compromised the distribution channel for Adform’s tracking infrastructure and injected malicious code into a widely used JavaScript file, `trackpoint-async.js`, hosted on `s2.adform.net`.

Because adtech tracking scripts are deployed globally across thousands of third-party websites, the single point of compromise allowed the attackers to deliver malicious payloads downstream to unsuspecting web visitors. Once loaded in a visitor’s browser, the poisoned script functioned as a client-side cryptocurrency clipper. Adform detected the intrusion on July 27, remediated the affected asset, notified client organizations, and reported the breach to relevant authorities.

Technical Impact and Mechanism

Unlike traditional adtech compromises that push drive-by downloads or aggressive phishing pop-ups, this campaign targeted cryptocurrency transactions silently within active browser sessions. When a user visited an affected website and copied or typed a Bitcoin, Ethereum, or Tron wallet address into a form field, the malicious JavaScript intercepted the input in real-time.

The script immediately replaced the victim's destination wallet address with an attacker-controlled receiving address. Cybersecurity researcher Kevin Beaumont reported that the malicious script actively monitored inputs: even if a victim noticed the altered address and attempted to re-copy the correct address, the script continuously overwrote the clipboard content as long as the web page remained open. Furthermore, because the initial payload was hosted on a legitimate ad network CDN, early scans across security engines like VirusTotal showed zero detections, allowing the compromise to bypass standard browser-level web filtering.

Protective Actions & Mitigation Guidance

While Adform removed the malicious file from its servers on July 27, 2026, static resources like JavaScript files are frequently cached locally by web browsers. As a result, users and website administrators must take proactive remediation steps:

1. Clear Browser Cache: End-users should immediately clear their web browser cache and cookies to ensure any lingering local copies of `trackpoint-async.js` are purged. 2. Manual Address Verification: Cryptocurrency users must visually check every character of a receiving address on their wallet interface before finalizing any transaction. 3. Hardware Wallet Controls: Use hardware wallets or secure wallet applications that require on-device screen confirmation of the final recipient address before broadcasting transactions to the network. 4. Implement Subresource Integrity (SRI): Web developers and site operators loading third-party scripts should enforce Subresource Integrity (SRI) hashes to prevent altered or tampered external scripts from executing in client browsers.