Cybersecurity entity
Every one of those 1 sits in a single category, threat-intel. Adform is the most frequent co-covered peer, appearing in 1 of the 1 tracked story. The tracked stories average 2 original sources each. Max Maass appears in 1 tracked Cybersecurity story from August 2, 2026.
Last mentioned: Aug 2, 2026
Entity pulse
Coverage balance Negative coverage leads. Negative coverage exceeds positive coverage by 100 percentage points.
Figures are computed live from our source-verified story record — see our methodology for how impact and sentiment are derived.
Every one of those 1 sits in a single category, threat-intel. Adform is the most frequent co-covered peer, appearing in 1 of the 1 tracked story. The tracked stories average 2 original sources each. Max Maass appears in 1 tracked Cybersecurity story from August 2, 2026.
Computed from the 1 stories linked to this entity, with beat comparisons drawn from all 4 Cybersecurity stories published in the same date window. Shares are omitted below five stories and comparisons below a twenty-story baseline.
Coverage cohort
Other entities that clear the same relevance threshold in stories also covering Max Maass. Shared-story counts are live from our verified record — not editorial picks.
Public disclosure and media coverage
Kevin Beaumont publicly releases details of the attack; news outlets The Hacker News and unsafe.sh publish reports.
Malicious code injected into Adform's trackpoint-async.js
Attackers modify the JavaScript file to swap cryptocurrency wallet addresses. The script is served from s2.adform[.]net to customer sites.
Adform detects and removes the malicious code
Adform identifies the compromise, deletes the poisoned file, and begins notifying affected clients.
Adform issues cache-clearing advisory
The company warns that the altered file may remain in browser caches and recommends users clear their cache to prevent continued execution.
Kevin Beaumont observes ongoing malicious activity
Beaumont reports seeing the wallet-swapping behavior via Adform over the past week, extending beyond the initial remediation.
A web supply chain attack poisoned Adform's trackpoint-async.js to replace Bitcoin, Ethereum, and Tron addresses on any site using the script, evading all VirusTotal detections and highlighting gaps in browser-based threat detection.
Max Maass is linked from 1 story on this site, each scored at or above our 35% relevance threshold — see how these pages are built.
See something wrong on this page — a misattributed entity, a wrong stat, a broken source link? Report a data issue.
