Online Ad Firm Adform's Script Compromised to Steal Cryptocurrency

Online advertising firm Adform suffered a supply-chain attack in which attackers compromised a third-party JavaScript script loaded by Adform's ad delivery platform. The poisoned script silently replaced cryptocurrency wallet addresses copied to visitors' clipboards — a technique known as clipboard hijacking or a crypto clipper attack.

Because Adform's ad platform serves JavaScript to a large number of websites simultaneously, the compromised script had a broad potential reach across every site using Adform's ad delivery network.

How Clipboard Hijacking Works

Cryptocurrency transactions require users to copy a long wallet address and paste it into a send field. Clipboard hijackers exploit this workflow:

1. Malicious JavaScript monitors the user's clipboard via the navigator.clipboard API or DOM event listeners
2. When the script detects a string matching a cryptocurrency wallet address pattern (Bitcoin, Ethereum, etc.), it silently replaces the clipboard contents with the attacker's wallet address
3. The user pastes what they believe is the correct recipient address, but sends funds to the attacker instead
4. The transaction is irreversible — cryptocurrency transfers cannot be recalled once confirmed

The attack is particularly dangerous because it is invisible: there is no popup, no warning, and no visual change. Users only notice when they check the transaction after the fact — often too late.

The Supply Chain Vector

Rather than directly attacking Adform's infrastructure, attackers targeted a third-party dependency loaded by Adform's ad script. This is a classic supply-chain attack pattern: instead of breaching a hardened primary target, compromise a smaller vendor or dependency that the primary target trusts and loads automatically.

The compromised script was delivered through Adform's ad platform, meaning every website using Adform ads was potentially serving the malicious clipboard-hijacking code to its visitors — without any knowledge of the compromise.

This approach multiplies the attacker's reach dramatically. A single compromised upstream dependency can poison thousands of downstream sites simultaneously.

Scope and Impact

Adform is a global digital advertising platform serving a wide range of publisher websites. The precise number of affected sites and the duration of the compromise were not immediately disclosed. However, given that ad scripts execute on page load and Adform serves inventory across numerous publisher properties, the potential victim pool spans any visitor who:

• Visited an Adform-powered site during the compromise window
• Copied a cryptocurrency wallet address while on that site

Attackers likely targeted high-value moments: users visiting crypto exchanges, DeFi platforms, NFT marketplaces, or any site where wallet addresses might be copied.

What Organizations Should Do

For Website Operators Using Adform

1. Review your ad implementation — check whether you load third-party ad scripts from Adform or its dependencies
2. Audit your Content Security Policy (CSP) — a strict CSP that disallows unauthorized script sources could have mitigated this attack
3. Monitor third-party script integrity — use Subresource Integrity (SRI) hashes for scripts you load:

<!-- SRI hash pins the exact expected content of an external script -->
<script src="https://cdn.example.com/script.js"
        integrity="sha384-<hash>"
        crossorigin="anonymous"></script>

4. Implement third-party script monitoring — tools like RiskIQ, Reflectiz, or Feroot can alert on unexpected changes to loaded scripts

For End Users

• Always verify wallet addresses after pasting — compare the first and last 6+ characters visually before confirming any transaction
• Use a hardware wallet or wallet software with built-in address verification
• Consider disabling clipboard API access for sites where you do not expect ad-served JavaScript to need it (browser extensions can restrict this)
• Be especially cautious on any cryptocurrency transaction — the irreversibility makes clipper malware uniquely destructive

The Broader Picture: Ad Platform Supply Chain Risk

This attack is a textbook example of the digital supply chain risk that every website carrying third-party JavaScript faces. Advertising scripts, analytics tags, chat widgets, and A/B testing tools all execute with the same trust level as first-party code — yet they are maintained by external vendors whose security posture the website operator cannot directly control.

Major ad platform compromises in recent years have repeatedly demonstrated this attack surface. The clipboard hijacking variant specifically targets the moment of highest financial intent — when a user is actively initiating a crypto transaction — making it among the most financially destructive categories of web-based malware.

Adform said it became aware of the incident and worked to remove the malicious code from its delivery pipeline. The company has not publicly detailed the full extent of the compromise or the duration of exposure.

References

• BleepingComputer — Online Ad Firm Adform's Script Compromised to Steal Cryptocurrency