MediumAdform compromised to serve crypto stealer via supply chain attack | by Kevin Beaumont | Jul, 2026 | DoublePulsarSitemapOpen in appSign up<br>Sign in
Medium Logo
Get app<br>Write
Search
Sign up<br>Sign in
Mastodon
DoublePulsar
Cybersecurity from the trenches, written by Kevin Beaumont. Opinions are of the author alone, not their employer.
Adform compromised to serve crypto stealer via supply chain attack
Kevin Beaumont
3 min read·<br>Just now
Listen
Share
Adform are an advertising company used by around 14k companies, owning around a 30% share of the demand-side category.<br>They operate by offering a Javascript embed for websites, via this URL:<br>hxxps://s2.adform.net/banners/scripts/st/trackpoint-async.js<br>This script was compromised to serve a crypto stealer. Adform have been hacked. As far as I can tell Adform haven’t told people.<br>This allows end user devices of downstream websites to be compromised with crypto stealing malware. Meaning if you visit example.com and they use Adform, example.com will compromise your device.<br>An example of what is being served by s2.adform.net:
Press enter or click to view image in full size
File hash 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55<br>That file flags as fine across vendors on Virustotal (all the URLs, files, domains and IPs flag as clean across all security vendors).<br>Press enter or click to view image in full size
The actual file served, trackpoint-async.js, had malicious code starting at this function:
The code in this sample matches valid Bitcoin, Etherum and TRX wallets in clipboard:<br>Press enter or click to view image in full size
It then replaces said addresses in clipboard with
The wallet values are swapped for attacker controlled wallets. Addresses appear to vary.<br>Get Kevin Beaumont’s stories in your inbox
Join Medium for free to get updates from this writer.
Subscribe
Subscribe
Remember me for faster sign in
It does this by polling every 3 seconds, then swapping addresses in clipboard:
Even if you notice the address is wrong and recopy the wallet, it keeps replacing it.<br>Other scripts directly served by Adform include ones which poll out to the attacker:<br>Press enter or click to view image in full size
Aside from crypto fraud, they also record the IP address of the user, the website they arrived from (i.e. the supply chain bit of the compromise) and the URL path.<br>The attacker server is 84.32.102.230 on port 7744<br>An example request:<br>hxxp://84.32.102.230:7744/p?h=example.com&u=/test<br>It appears Adform may be aware, or the attacker has realised they’ve been rumbled, as the malicious code appears to be disappearing as I type this out. I can see malicious activity via Adform over the past week, and the security industry appears to have entirely missed it.<br>Example full script served by Adform for reverse engineers:<br>https://pastebin.com/mc7psaNF<br>IoCs<br>84.32.102.230 — beacon<br>s2.adform.net<br>hxxps://s2.adform.net/banners/scripts/st/trackpoint-async.js
Cryptocurrency
Malware
Cybersecurity
Cybersecurity News
Published in DoublePulsar<br>9.7K followers<br>·Last published just now
Cybersecurity from the trenches, written by Kevin Beaumont. Opinions are of the author alone, not their employer.
Written by Kevin Beaumont<br>19.6K followers<br>·94 following
Everything here is my personal work and opinions.
Help
Status
About
Careers
Press
Blog
Store
Privacy
Rules
Terms
Text to speech