Adform: the shared tracking script every customer site embeds was trojanised with a clipboard-rewriting crypto-clipper, and no antivirus engine flagged it

Adform, an advertising-technology platform headquartered in Copenhagen, has confirmed a compromise of its platform in which, in the company's own words, the code "was designed to interfere with certain cryptocurrency transactions involving Bitcoin, Ethereum, or Tron by attempting to replace a cryptocurrency wallet address copied to a user's clipboard with a different address"; it says it detected the activity on 2026-07-27, contained the incident, removed the malicious code and reported it to the authorities (Adform, 2026-07-31). Adform's notice does not identify the affected asset. That identification comes from the reporting: independent researcher Kevin Beaumont discovered the compromise and traced it to trackpoint-async.js, Adform's JavaScript tracking script served from s2.adform.net and embedded in websites using the platform (BleepingComputer, 2026-07-31). Adform's implementation documentation allows that tag to run on one page, several sections, or unconditionally across an entire website, and compromising the shared resource is what gave the attackers a route onto unrelated downstream sites without breaching any of them individually (The Hacker News, 2026-08-01).

The captured sample carries two malicious blocks appended to the end of the legitimate library, their replacement strings obfuscated with a six-byte XOR key. The first watches for the copy event, polls the clipboard every four seconds and substitutes matching addresses; the second walks the document's text nodes, rewrites values in input, textarea and contenteditable elements, restores the cursor position afterwards, and hooks the value setter on input and textarea elements so that programmatic writes are rewritten in transit — it also intercepts copy, cut, paste and input events, so clipboard copying was never the only path to replacement (The Hacker News, 2026-08-01). Beaumont's description of the user experience is the operationally important part: "Even if you notice the address is wrong and recopy the wallet, it keeps replacing it" (The Hacker News, 2026-08-01). BleepingComputer separately analysed an archived copy and confirmed a self-executing obfuscated payload appended to the legitimate library, including a function that replaced any string matching a wallet-address format and logic that rewrote addresses displayed on the page (BleepingComputer, 2026-07-31). At the time of the researcher's report the file returned no detections on VirusTotal (The Hacker News, 2026-08-01).

Two questions are openly contested and defenders should not resolve them in Adform's favour by default. On duration, Adform's notice says the incident "may have affected individuals who visited a website using the affected Adform technology on 27 July 2026", a single day (Adform, 2026-07-31), while Beaumont says the activity had run for about the preceding week and the oldest sample BleepingComputer could locate came from an archived snapshot taken on 2026-07-26 at 23:29 GMT (BleepingComputer, 2026-07-31); The Hacker News states plainly that "The public timeline is unresolved." (The Hacker News, 2026-08-01). On data egress, Adform reports "no evidence that the malicious code transmitted users' IP addresses or information about the websites they visited to an external party" while conceding that "Technical analysis indicates that such transmission may have been possible." (Adform, 2026-07-31); the analysed sample contains a request on page load built to send the hostname and path of the page the visitor is on to an external server, though whether it reached the operator is not established by the sample alone (The Hacker News, 2026-08-01). Adform has published no indicators of compromise, has not said how the attackers reached its deployment path, and has not identified the attacker; The Hacker News notes the more useful missing figure is how many page loads actually received the altered resource, which the company has not disclosed (The Hacker News, 2026-08-01).

Detection concepts follow directly from the mechanism, and the honest starting point is that the server-side victim organisation has almost no native telemetry here — the payload executes in the visitor's browser, not on the operator's infrastructure. The vantage that would have fired is a restrictive Content-Security-Policy with a connect-src allowlist and violation reporting on any page embedding third-party tags: the injected block's outbound request to infrastructure outside the vendor's documented endpoints is a reportable violation the moment it is attempted. On managed endpoints, browser-process egress telemetry showing connections to destinations outside a tag vendor's published endpoint list while that vendor's script is loaded is the equivalent network-side signal. Triage: legitimate ad and analytics tags make outbound beacon and XHR calls constantly, so the call itself discriminates nothing — what no legitimate tracking pixel needs to do is mutate clipboard contents or rewrite the value of form input elements, and a tag script hooking copy, cut, paste and input-value setters is the behaviour that separates this from ordinary telemetry. Hardening: Subresource Integrity hashes on statically versioned third-party scripts break loudly the moment a vendor-hosted asset is modified server-side, and are worth requesting from any tag supplier that does not currently offer a pinnable, hashable asset; where SRI is not available a restrictive CSP bounds the blast radius rather than preventing the substitution itself.