Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites

A $60B Vote of Confidence

Adform, a major advertising technology company, has been compromised by hackers. The attackers modified a JavaScript file served by Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. This incident highlights the risks of supply-chain attacks, where hackers compromise a third-party service to gain access to a larger system. In this case, the hackers targeted Adform's JavaScript file, which is used by many websites to display ads. The compromised file was served from s2.adform[.]net, and it contained two malicious blocks that were appended to the legitimate library. The first block watched for the copy event, tried to read the clipboard every four seconds, and replaced matching addresses. It also attempted an HTTP request to 84.32.102[.]230:7744 on page load that included the hostname and path of the page the visitor was on. The second block walked the document's text nodes, rewrote values in input, textarea, and contenteditable elements, and restored the cursor position after a rewrite. It hooked the value setter on input and textarea elements, so programmatic writes were rewritten in transit. It also intercepted copy, cut, paste, and input events. Both blocks contained hardcoded replacement strings for Bitcoin, Ethereum, and Tron address patterns, and Beaumont said the addresses appeared to vary. Adform says it found no evidence that the code transmitted visitors' IP addresses or information about websites they visited. However, technical analysis indicates that such transmission may have been possible. The first payload's request was built to send a page hostname and path to the outside server; whether it reached the operator is not established by the sample. Most of the scope is still missing: how many websites carried the file, how many visitors were exposed, how the attackers reached Adform's deployment path, and whether any funds were diverted. The duration gap also prevents a defensible exposure estimate because Adform's July 27 affected-date statement and Beaumont's longer observation remain unreconciled. Adform's public incident notice lists no indicators of compromise. Adform's 2025 annual report says the company had roughly 1,800 customers, enabled 1.5 billion ads to be displayed daily, and served or transacted ads in more than 180 countries during 2025. Those figures describe the platform, not this incident. A more useful number is how many page loads actually received the altered resource, a count Adform has not published. Adform has not publicly identified the attacker.

Why Cursor?

Beaumont, an independent security researcher, disclosed the compromise and wrote, "Even if you notice the address is wrong and recopy the wallet, it keeps replacing it." Beaumont reported that the file and its associated URLs, domains, and IP addresses returned no detections on VirusTotal at the time. Max Maass published a captured copy of the script on July 27. The captured sample contains two malicious blocks appended to the legitimate library. Their replacement strings are obfuscated with a six-byte XOR key. The first watches for the copy event, tries to read the clipboard every four seconds, and to replace matching addresses. It also attempts an HTTP request to 84.32.102[.]230:7744 on page load that includes the hostname and path of the page the visitor is on. The second block walks the document's text nodes, rewrites values in input, textarea, and contenteditable elements, and restores the cursor position after a rewrite. It hooks the value setter on input and textarea elements, so programmatic writes are rewritten in transit. It also intercepts copy, cut, paste, and input events. Both blocks contain hardcoded replacement strings for Bitcoin, Ethereum, and Tron address patterns, and Beaumont said the addresses appeared to vary.

The Road Ahead

Adform says it found no evidence that the code transmitted visitors' IP addresses or information about websites they visited. However, technical analysis indicates that such transmission may have been possible. The first payload's request was built to send a page hostname and path to the outside server; whether it reached the operator is not established by the sample. Most of the scope is still missing: how many websites carried the file, how many visitors were exposed, how the attackers reached Adform's deployment path, and whether any funds were diverted. The duration gap also prevents a defensible exposure estimate because Adform's July 27 affected-date statement and Beaumont's longer observation remain unreconciled. Adform's public incident notice lists no indicators of compromise. Adform's 2025 annual report says the company had roughly 1,800 customers, enabled 1.5 billion ads to be displayed daily, and served or transacted ads in more than 180 countries during 2025. Those figures describe the platform, not this incident. A more useful number is how many page loads actually received the altered resource, a count Adform has not published. Adform has not publicly identified the attacker.