Attackers tampered with a JavaScript file served by advertising technology firm Adform, turning the shared tracking script into a browser-side tool that rewrites cryptocurrency wallet addresses on any site running it.
Adform detected the tampering on July 27, scrubbed the malicious code, alerted affected clients, and reported the case to authorities. Independent researcher Kevin Beaumont, who broke the story publicly, said he had spotted malicious activity flowing through Adform across the previous week.
The poisoned resource is trackpoint-async.js, served from s2.adform[.]net, and the attack is a supply chain compromise: a single modified file gave the intruders a route into unrelated downstream sites without breaching each one individually.
Anyone who visited an affected page and copied a Bitcoin, Ethereum, or Tron address on July 27 may have pasted a different address inserted by the malicious code. The captured sample contains two malicious blocks appended to the legitimate library, with replacement strings obfuscated by a six-byte XOR key. One block watches for copy events, polls the clipboard every four seconds, and swaps matching addresses. The other walks the document’s text nodes, rewrites values in input fields and contenteditable elements, and hooks value setters so even programmatic writes are replaced in transit.
Beaumont warned that recopying an address does not help: the script keeps replacing it while the page stays open. The code also attempts an HTTP request to a hardcoded IP address on page load, carrying the hostname and path of the page the visitor is on.
Adform’s guidance is to clear the browser cache, because the altered file could survive in cache after the cleanup, and to double-check any wallet address before sending funds. The company says the code was never built to install software or keep persistence, and it acted only while an affected page was open.
