Supply Chain Attack via Adform Script Evaded VirusTotal, Swapped 3 Cryptos

For cybersecurity teams, the Adform incident is a textbook supply chain attack with a pure browser payload that sidestepped every AV engine on VirusTotal. This deep dive breaks down the TTPs and the defensive failures that allowed a malicious script to rewrite crypto transactions on thousands of sites.

A sophisticated supply chain attack leveraged Adform's advertising technology infrastructure to covertly replace cryptocurrency wallet addresses across an unknown number of customer websites. Detected on July 27, 2026, the attackers modified a core JavaScript file—trackpoint-async.js, served from s2.adform[.]net—to intercept and rewrite Bitcoin, Ethereum, and Tron addresses both on the clipboard and in directly typed form fields. Adform quickly removed the malicious code, notified affected clients, and reported the incident to authorities, but the company cautions that the poisoned file may remain cached in users' browsers, prolonging the threat beyond the initial remediation.

“

Detected on July 27, 2026, the attackers modified a core JavaScript file—trackpoint-async.js, served from s2.adform[.]net—to intercept and rewrite Bitcoin, Ethereum, and Tron addresses both on the clipboard and in directly typed form fields.

The attack's mechanism is particularly insidious. Rather than merely altering copied addresses, the script continuously replaced any wallet string it recognized while the compromised page remained open. According to security researcher Kevin Beaumont, who publicly disclosed the incident, 'Even if you notice the address is wrong and recopy the wallet, it keeps replacing it.' This persistence made it nearly impossible for a user to complete a legitimate transaction without manually verifying the address on a separate, uncompromised device. A captured sample also confirmed that the script targeted form fields directly, circumventing clipboard-based protections entirely.

Because Adform's tracking code can be deployed across entire websites—not just individual pages—the compromise represents a broad supply chain threat. Any site embedding Adform's script on July 27 could have exposed visitors to the wallet-swapping behavior, regardless of the site's own security posture. This shared-resource vector allowed the attackers to reach downstream targets without breaching each site individually, echoing high-profile supply chain incidents in the software world. Notably, Beaumont reported that the malicious file and its associated infrastructure returned zero detections on VirusTotal at the time of analysis, indicating a significant gap in threat detection for browser-level compromises.

The immediate impact is financial: anyone who copied or entered a wallet address on an affected site during the window of compromise may have inadvertently sent funds to an attacker-controlled wallet. The three targeted cryptocurrencies—Bitcoin, Ethereum, and Tron—are among the most widely used, amplifying the potential losses. While no specific theft figures have been reported, the attack's wide distribution and stealthy design suggest a high potential for silent theft. Adform's advisory to clear browser caches underscores the subtle persistence: a cached malicious script can continue to execute even after the server-side fix, making user action essential for full remediation.

Beyond the immediate crypto threat, the incident exposes systemic vulnerabilities in the adtech ecosystem. Adform is a major player in programmatic advertising, and its scripts are integrated into thousands of publisher sites, e-commerce platforms, and content portals. A compromise at this level challenges the trust model that underpins digital advertising: if a single third-party resource can turn any site into a financial fraud vector, brands, publishers, and consumers alike must reassess the security of third-party dependencies. The attack also illustrates the evolution of web-based threats, where malicious code operates purely in the browser to manipulate user transactions without leaving traditional malware footprints.