Online ad firm Adform’s script compromised to steal cryptocurrency
Online advertising firm Adform suffered a supply-chain attack that delivered cryptocurrency-stealing scripts to websites using its ad platform, replacing wallet addresses copied to visitors’ clipboards with ones controlled by an attacker.
Intelligence analysis by Llama
Adform, a European adtech firm, had its JavaScript tracking script compromised, allowing attackers to steal cryptocurrency by replacing wallet addresses with ones controlled by the attacker.
Imagine you're visiting a website that uses a tracking script to follow your online activities. However, this script has been compromised by hackers, who can steal your cryptocurrency by replacing your wallet address with one controlled by them. This is what happened to Adform, a European adtech firm, which had its tracking script compromised to steal cryptocurrency.
Analysis
A $60B Vote of Confidence
Adform, one of Europe's largest adtech firms, has suffered a supply-chain attack that delivered cryptocurrency-stealing scripts to websites using its ad platform. The attack, which was discovered by security researcher Kevin Beaumont, allowed attackers to replace wallet addresses copied to visitors' clipboards with ones controlled by the attacker. This means that if a user visited a website that embedded Adform's tracking script, their device could be compromised with crypto-stealing malware.
Beaumont observed that the malicious Adform-hosted script continuously monitored the clipboard of users visiting websites that embedded the tracking script. If the script detected Bitcoin, Ethereum, or TRON wallet addresses, it replaced them with an attacker-controlled address to redirect cryptocurrency payments. The researcher also noted that the malicious code was removed from Adform's tracking script soon after his discovery.
Adform confirmed its detected suspicious activity on July 27 and discovered a 'cybersecurity threat.' The company said that it removed the malicious code and 'took further measures to protect website visitors, our clients, and the Adform platform.' However, individuals who visited websites that embedded the 'affected Adform technology on 27 July 2026' are still impacted, and the recommendation is to clear browser cookies to eliminate the malicious code.
The attack highlights the importance of security in the adtech industry and the potential for supply-chain attacks to compromise user devices. It also underscores the need for companies to regularly test and update their security measures to prevent such attacks.
Key points
- Adform, a European adtech firm, suffered a supply-chain attack that delivered cryptocurrency-stealing scripts to websites using its ad platform.
- The attack allowed attackers to replace wallet addresses copied to visitors' clipboards with ones controlled by the attacker.
- Adform removed the malicious code and took further measures to protect website visitors, clients, and the Adform platform.
- Individuals who visited websites that embedded the affected Adform technology on July 27, 2026, are still impacted and are recommended to clear browser cookies to eliminate the malicious code.
If Adform's security measures are effective in preventing similar attacks in the future, users can feel more secure when visiting websites that use the company's ad platform.
However, the attack also highlights the potential for supply-chain attacks to compromise user devices, which could lead to further security risks and financial losses.
