For about a week, visiting an ordinary website was enough to have your cryptocurrency payment redirected to a stranger. The Adform supply chain attack put malicious code inside a tracking script served by one of Europe's largest advertising technology firms, and every site that embedded that script passed the code straight to its visitors. Security researcher Kevin Beaumont found it on 27 July 2026. No antivirus engine had flagged it.
How the Adform supply chain attack worked
The compromised file was trackpoint-async.js, Adform's JavaScript tracker served from s2.adform.net and embedded on the sites of its customers. Someone appended obfuscated code to the end of the legitimate library, so the file kept doing its normal job while carrying a payload. Nothing was installed on the visitor's machine. The script simply ran in the page, like every other script the site had chosen to load.
What it did there was narrow and effective. Beaumont's analysis showed the code polling the clipboard every three seconds, testing the contents against the formats of Bitcoin, Ethereum and TRON addresses, and if it found a match, replaced it with an attacker-controlled wallet. The substitute addresses varied. Recopying the correct address did not help, because the next poll replaced it again. Later analysis showed the code could also rewrite wallet addresses displayed on the page and typed into form fields, so the clipboard was not the only path.
The part that was not about crypto
The same infrastructure quietly collected reconnaissance. Alongside the wallet swap, scripts served through Adform beaconed out to 84.32.102.230 on port 7744, sending the visitor's IP address, the website they were on and the path they were viewing. That is a functioning tracking system built on top of a tracking system, running for the benefit of whoever owned the malicious code. Anyone who has argued that ad scripts are only a privacy nuisance now has a counterexample: the same pipe that reports your browsing to an advertiser can report it to an attacker.
A week of silence and clean antivirus verdicts
The oldest sample recovered came from an Archive.org snapshot dated 26 July 2026, and Beaumont observed malicious activity through Adform over the preceding week. During that time the file, the URLs, the domain and the attacker IP were all rated clean by every vendor on VirusTotal. This is the uncomfortable part of the story. The payload was not hiding in an obscure corner of the internet, it was being served by a company whose reach Beaumont put at around 14,000 client companies and roughly a 30 percent share of the demand-side advertising market, and the security industry missed it. The malicious code began disappearing while he was writing his findings up.
What Adform did and what visitors should do
Adform confirmed the incident, removed the malicious code, notified affected clients and reported the matter to the authorities. The company says the code was not designed to install software on a device or to establish persistence, and that it worked only while an affected page was open. It also asked users to clear the browser cache and cookies, because a cached copy of the modified file can keep running after the fix. The practical checklist for anyone who moves cryptocurrency is short: clear the cache, verify the destination address on the receiving device rather than on the page you copied it from, and send a small test transaction before a large one.
One script, thousands of front doors
This is the shape modern supply chain attacks take. Nobody breached 14,000 companies. One vendor was breached, and 14,000 companies delivered the result to their visitors, because a third-party script runs with the same privileges as the site that loads it. We have covered the privacy version of this problem before, when ChatGPT was quietly sending query summaries to Meta through the Facebook pixel, and the automated version, when an AI agent escaped its sandbox and poisoned a public package repository. The defence has not changed: block third-party scripts and trackers by default, because every one you allow is a company you have decided to trust with code execution on your machine. A content blocker such as uBlock Origin is the practical form of that rule, and adform.net sits on the standard tracker blocklists those tools use, so many people running one never received the file at all. A VPN hides which network you connect from, and it is worth noting that this beacon was logging exactly that, but no VPN stops a script the site itself invited in.
