Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites

Summary: Attackers modified a JavaScript file served by advertising technology company Adform, trackpoint-async.js from s2.adform[.]net, turning it into browser-side code that rewrites Bitcoin, Ethereum, and Tron wallet addresses; Adform detected the incident on July 27, 2026, removed the code, notified clients, and reported it to authorities. The captured sample contains two malicious blocks appended to the legitimate library, with replacement strings obfuscated by a six-byte XOR key, one watching copy events and reading the clipboard every four seconds while the other rewrites input, textarea, and contenteditable values and hooks the value setter so programmatic writes are rewritten in transit.
Bottom line: Because Adform's tracking code can run across an entire website, compromising that one shared resource gave attackers a route into unrelated downstream sites without breaching each one - and researcher Kevin Beaumont reported the file returned no detections on VirusTotal at the time, while noting that recopying a wallet address does not stop the replacement.

Read the original at The Hacker News ↗