Adform tracking script hijacked to serve crypto clipper

On July 30, 2026, security researcher Kevin Beaumont reported that Adform, a European ad-tech company, had been serving a cryptocurrency stealer from one of its own JavaScript files. The compromised script, trackpoint-async.js, is hosted on s2.adform.net and loaded by roughly 14,000 businesses that use Adform's advertising technology, so the malicious code reached ordinary visitors of thousands of unrelated websites.

Adform sells advertising and measurement services, and its tracker is the sort of third-party file a marketing team adds once and never revisits. The injected code took advantage of exactly that. It polled the visitor's clipboard every three seconds and, whenever it found something shaped like a Bitcoin, Ethereum, or TRON wallet address, replaced it with an address the attackers controlled. It also rewrote wallet addresses displayed on the page itself, so a victim who checked the screen before pasting saw the attacker's address rather than the one they intended to pay.

The script reported back to a bare IP address, 84.32.102.230, on port 7744, sending the visitor's address and the page they had come from in a request shaped like /p?h=example.com&u=/test. Beaumont noted that neither the file nor its associated URLs, domains, or IP address returned a single detection on VirusTotal while the campaign was live, which is a reasonable illustration of how little reputation scanning helps against a trusted vendor's own hostname.

Adform removed the malicious code and notified customers, and the injected script had begun disappearing while Beaumont's write-up was being published. Anyone who visited a site carrying the Adform tracker during the window was advised to clear browser cookies. No sample of the modified script carries a published digest, so the affected bytes are identified by the URL and behavior rather than by hash.