Anoymask

Adform Delivery Script Compromised: Wallet Addresses Replaced on Clipboard and Screen

1. Basic Information

Related Information Sources

2. Summary

An obfuscated JavaScript is added to a legitimate ad tracking library. This is a supply chain attack that replaces cryptocurrency destination addresses on the user's clipboard and web pages with the attacker's address when they visit infected sites.

3. Attack Flow

Wallet Replacement via Ad Delivery Supply Chain

  1. The attacker compromises Adform's delivery infrastructure or the trackpoint-async.js generation path.
  2. A self-executing obfuscated payload is injected into the end of the legitimate tracking library at s2.adform.net.
  3. Many downstream sites using Adform deliver the script to user browsers.
  4. The script continuously monitors the clipboard while the page is open and detects Bitcoin, Ethereum, and TRON address patterns.
  5. It replaces the detected string with the attacker's wallet. It also rewrites the wallet address displayed on the page.
  6. Another Adform-hosted script sends the victim's IP, referrer, and URL path to 84.32.102[.]230:7744.

4. Attacker Position and Execution Location

  • Point of Compromise: Adform's legitimate JavaScript delivery path
  • Execution Location: User browser context while viewing downstream websites
  • Data Exfiltration: 84.32.102[.]230:7744 and the attacker's wallet

5. Visibility for Victims and Administrators

Victims / Users

  • The website displays normally. Only the destination address changes when copying, pasting, or viewing the screen.
  • Adform states that no software was installed or restarted, and the impact was limited to the time the page was open.

Administrators / SOC

  • Hash/content drift in the legitimate s2.adform.net script, with obfuscated IIFE at the end.
  • Communication from the browser to a non-business IP:port (7744), and wallet address DOM/clipboard mutation.

6. Success and Failure Conditions

Success Conditions

  • A site embeds the affected version of trackpoint-async.js.
  • A user opens the page during the impact period around 2026-07-27.
  • Script and clipboard operations are allowed in the browser.
  • The user finalizes the transaction without verifying the destination address through an independent path.

Failure Conditions

  • CSP/SRI or self-hosted pinned scripts block the modified version.
  • Ad/third-party script isolation or blocking is active.
  • The user verifies the destination address on a hardware wallet screen or via another channel.
  • Network traffic to 84.32.102[.]230:7744 is blocked.
  • Cache/cookies are cleared after Adform removes the malicious code.

7. What Happens on Success

  • Irreversible erroneous cryptocurrency transfers to the attacker's wallet.
  • External transmission of the browsing IP, referrer, and URL path.
  • Simultaneous infection of multiple downstream sites from a single delivery point.
  • According to Adform, software installation and persistence are not designed into the attack.

8. Observable Logs

Email

  • No direct elements.

Proxy/SWG/DNS

  • Retrieval of trackpoint-async.js from s2.adform.net, connections to 84.32.102[.]230:7744, and script hash/content differences.

Endpoint/EDR

  • File and process artifacts are limited because it is JavaScript running inside the browser process. Check browser cache, history, and DevTools memory.

Identity/IdP

  • No authentication compromise has been confirmed.

SaaS/Cloud

  • CDN/ad platform publish logs, object/version/audit logs, and downstream tag manager change history.

Network

  • Chain of browser -> Adform CDN -> attacker IP. Focused on domain/IP/port if TLS inspection is absent.

9. Attack Success Determination

  • Contact Only: Visited affected site and downloaded script.
  • User Action: Copied/pasted wallet address or viewed the page.
  • Initial Execution: Malicious JS executed in the browser.
  • Malware Success: Confirmed clipboard/DOM address replacement.
  • Info Theft / Session Compromise: IP/referrer/path sent. Credential/session theft unconfirmed.
  • Subsequent Compromise: Erroneous transfer transaction completed on the blockchain. Persistence unconfirmed.

10. Investigation Playbook

  • Trigger: Visit history to Adform-using sites, connection to 84.32.102[.]230:7744, and wallet destination mismatch.
  • Initial Verification: Compare visit time with the impact window on 2026-07-27, and preserve script/cache/hash.
  • Endpoint: Collect browser cache/history, clipboard manager logs, wallet transactions, and extension lists.
  • Authentication/Cloud: Check separately for signs of credential compromise. Site operators investigate CDN/tag manager/audit logs.
  • Subsequent Actions: Fix the source of funds, txid, address before/after pasting, and attacker address, then coordinate with exchanges/legal teams.
  • Containment: Stop the affected script, clear cache/cookies, apply CSP/SRI, block the attacker IP, and notify users.
  • Classification: Script Delivered / JS Executed / Address Replaced / Telemetry Exfiltrated / Fraudulent Transfer

11. Defense and Detection Ideas

  • Single Indicator: Non-standard port 7744 traffic from browsers, hash drift in legitimate libraries.
  • Correlation: s2.adform.net fetch -> attacker IP communication -> clipboard/wallet operation -> transaction.
  • Hunting: Daily diffs of third-party JS, unexpected IIFE/obfuscation, DOM wallet address mutations.
  • Log Gaps: Browser script telemetry, clipboard audits, CDN object versions, tag manager audits, wallet transaction contexts.
  • Priority Measures: Third-party script inventory, SRI/CSP, CDN publish protection, out-of-band address verification for crypto transfers.

12. Facts / Inference / Hypothesis

Facts

  • An obfuscated self-executing payload was injected at the end of trackpoint-async.js.
  • The script replaced Bitcoin, Ethereum, and TRON wallet addresses on the clipboard and web page.
  • Another script sent the IP, referrer, and URL path to 84.32.102[.]230:7744.
  • VirusTotal did not initially detect the threat.
  • Adform detected the activity on July 27, removed the code, and stated there was no software installation or persistence.
  • Archive.org confirmed a sample from 2026-07-26 23:29 GMT.

Inference

  • SOCs must continuously monitor the content integrity of third-party scripts, even if legitimate CDN domains are allowed.
  • Devices handling crypto assets are vulnerable even when browsing general, non-financial sites.

Hypothesis

  • The same delivery compromise could be repurposed for credential form tampering, though this capability was not confirmed in this incident.

13. MITRE ATT&CK Mapping

  • T1195.002 – Compromise Software Supply Chain (Confidence: High)
  • T1189 – Drive-by Compromise (Confidence: High)
  • T1056.004 – Credential API Hooking / Clipboard Capture equivalent (Confidence: Medium)
  • T1027 – Obfuscated Files or Information (Confidence: High)
  • T1041 – Exfiltration Over C2 Channel (Confidence: Medium)
  • T1657 – Financial Theft (Confidence: High)

14. Unknowns and Additional Investigation

  • Initial vector of the Adform compromise.
  • Complete list of affected clients and sites.
  • List of replacement wallets and actual financial damage.
  • Exact start and end times for malicious code delivery.
  • Purpose of the data collected by 84.32.102[.]230.

15. Impact on Global SOCs and Enterprises

This issue directly affects enterprises and users handling cryptocurrency or Web3 operations who utilize foreign advertising and tracking tags. Vendors' domains should not be excluded from inspection just because they are considered "legitimate." Important sites should inventory third-party JavaScript, and dynamic scripts where SRI cannot be used should be supplemented with proxy content monitoring or isolated browsers.

16. Summary by Role

For SOCs

Do not treat regular Adform traffic as a standalone incident. Correlate impact times, script hashes, 84.32.102[.]230:7744 traffic, and wallet transactions.

For Administrators

Check Adform notification targets, stop scripts, clear caches/cookies, implement CSP/SRI, and monitor third-party code.

For Users

When sending cryptocurrency, verify the entire destination address (not just the beginning and end) using a hardware wallet screen or an alternative path after pasting.