Threat actors carried out a sophisticated supply chain attack against advertising technology company Adform, modifying a widely distributed JavaScript file to silently swap cryptocurrency wallet addresses displayed on customer websites. The malicious modification turned a legitimate ad-serving script into a browser-side cryptocurrency hijacking tool — hitting visitors across multiple Adform customer sites simultaneously.
What Happened
On July 27, 2026, Adform detected that one of its JavaScript files had been tampered with. The modified script contained code designed to monitor web pages for displayed cryptocurrency wallet addresses and replace them in real-time with attacker-controlled addresses.
When a visitor to an affected site attempted to copy a wallet address — for example, to send payment to a cryptocurrency exchange, vendor, or service — the browser-side script would substitute the legitimate address with the attacker's wallet, causing funds to be sent to the wrong destination.
Adform:
- Detected the incident on July 27, 2026
- Removed the malicious code promptly after discovery
- Notified affected clients
- Reported the incident to relevant authorities
The Supply Chain Angle
This attack is a textbook JavaScript supply chain attack — a category of threat that has grown significantly in recent years. The attack pattern exploits the trusted relationship between a third-party service provider and the websites that embed its scripts.
Because Adform's JavaScript file was served from Adform's infrastructure and embedded across numerous customer websites, a single compromise of the source file propagated the malicious code to all sites loading that script. Visitors on any of those sites were silently exposed to the wallet-swapping payload without any individual site having been directly compromised.
This is the same fundamental mechanism behind other notable supply chain attacks:
- Polyfill.io (2024) — malicious code injected into a widely embedded polyfill script
- Magecart campaigns — JavaScript skimmers injected into e-commerce payment pages
- XZ Utils (2024) — backdoor inserted into a widely used compression library
How Crypto Clippers Work
The malicious script likely functioned as a cryptocurrency clipboard hijacker or DOM manipulator:
- The script listens for cryptocurrency wallet addresses appearing in the DOM or being copied to the clipboard
- When a wallet address is detected, it is silently replaced with an attacker-controlled address
- The user, believing they are sending funds to the correct destination, initiates a transaction
- Funds arrive at the attacker's wallet instead
Cryptocurrency transactions are irreversible by design. Once funds are sent to the wrong address, recovery is generally impossible.
Who Is at Risk
Visitors to Adform customer websites during the period when the malicious script was active may have been targeted. Organizations that rely on Adform's ad technology and display cryptocurrency wallet addresses on their sites — such as crypto exchanges, DeFi platforms, blockchain projects, and fintech services — should:
- Audit transactions processed during the July 27 window for potential misdirection
- Notify customers who may have attempted cryptocurrency transfers during the exposure period
- Review third-party JavaScript embedded on their sites for any unexpected behavior
Broader Implications
This incident highlights the inherent risk of embedding third-party JavaScript without robust integrity controls. Site owners can reduce this risk through:
- Subresource Integrity (SRI) — cryptographic hash checks on third-party scripts ensure the file has not been modified
- Content Security Policy (CSP) — restrict which scripts can execute on your site
- Third-party script auditing — periodically review and inventory all embedded scripts
- Real User Monitoring (RUM) — detect anomalous DOM changes that may indicate injected malicious code
The ad tech ecosystem, which distributes JavaScript across millions of websites simultaneously, represents a high-value target for supply chain attackers seeking maximum reach from a single compromise.