Adform's supply-chain attack involved the compromise of its 'trackpoint-async.js' JavaScript tracking script served from 's2.adform.net'. The trojanized script monitored clipboard activity on websites embedding it and replaced Bitcoin, Ethereum, and TRON wallet addresses with attacker-controlled addresses, redirecting cryptocurrency payments. The malicious code was appended in obfuscated form to the legitimate library and also rewrote wallet addresses displayed on web pages. The attack was discovered by security researcher Kevin Beaumont and was active for about a week before removal. Adform confirmed the incident, removed the malicious code on July 27, 2026, and took further protective measures. The malicious script did not install persistent malware but operated only during page visits. Users who visited affected sites on July 27 are recommended to clear browser cookies to remove the malicious code.

The attack redirected cryptocurrency payments by replacing wallet addresses copied to clipboard or displayed on web pages with attacker-controlled addresses. This could lead to financial losses for users attempting cryptocurrency transactions on websites using Adform's ad platform during the compromise period. The malicious code did not install persistent malware or establish long-term device compromise but operated only while affected webpages were open. The supply-chain nature of the attack affected any website embedding the compromised Adform script, potentially impacting a broad user base.

Adform has removed the malicious code from its tracking script and taken additional protective measures. The services are currently safe to use. Users who visited websites embedding the affected Adform technology on July 27, 2026, should clear their browser cookies to eliminate any residual malicious code. Adform has communicated with affected clients and provided relevant information and recommended actions. No further action is required beyond these steps as the malicious code was removed promptly after discovery.