Observed Signal · Aug 1, 2026 · Supply Chain Attack · Source: DEV Community · Impact: 4/5 · Sentiment: Negative
Supply Chain Security / Ad Delivery Compromise Market: Adform Script Injected to Replace Crypto Wallet Addresses
A malicious, obfuscated JavaScript payload was injected into Adform's trackpoint-async.js delivery path, causing downstream sites that load the script to serve code which monitored users' clipboards and web pages for Bitcoin, Ethereum, and TRON addresses and replaced them with attacker-controlled wallet addresses. Adform detected and removed the code on July 27, 2026. The compromised script also sent victims' IP, referrer, and URL path to 84.32.102.230:7744. Initial detection by VirusTotal was lacking and Archive.org holds a sample timestamped 2026-07-26 23:29 GMT. The incident is classified as a supply-chain compromise of ad delivery infrastructure and highlights risks of trusting third-party advertising/tracking scripts without integrity protections such as SRI/CSP or content monitoring.
A supply-chain compromise of a widely delivered ad/tracking script affects many downstream sites, undermines trust in third-party ad infrastructure, enables financial theft and data exfiltration, and requires urgent SOC and publisher actions.
Key Takeaways & Evidence Grounding
- An obfuscated self-executing payload was injected into Adform's trackpoint-async.js served from s2.adform.net.
- The malicious script monitored clipboards and DOM content to detect and replace Bitcoin, Ethereum, and TRON addresses with the attacker's wallet.
- A separate script exfiltrated victims' IP, referrer, and URL path to 84.32.102.230:7744.
- Adform detected and removed the malicious code on 2026-07-27; Archive.org contains a sample from 2026-07-26 23:29 GMT.
- VirusTotal did not initially detect the threat.
Connected Companies & Entities
1 Entity mappedOntology Mapping & Concepts
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.