A piece of everyday advertising plumbing has turned into an unlikely infection vector. Security researcher Kevin Beaumont has documented how attackers compromised a JavaScript tracking file belonging to Adform, a demand-side advertising platform used by an estimated 14,000 businesses and holding close to a third of the DSP market, and quietly rewrote it to steal cryptocurrency from site visitors.

One File, Thousands of Websites

The tainted script sits on Adform’s own infrastructure and is embedded across a huge number of client websites to track advertising performance — the kind of file most site owners never think twice about. That ubiquity is exactly what made it valuable to attackers: corrupt a single shared script once, and every website that loads it inherits the infection automatically, with no separate breach needed at each individual site.

Anyone who simply visited a page carrying the compromised tracker could have had malicious code run in their browser without any other action on their part, which is the hallmark of a supply-chain compromise rather than a targeted attack against one organization.

A Clipboard Hijacker With a Long Memory

Once loaded, the injected code behaves as a clipboard hijacker tuned specifically for cryptocurrency theft. It polls the victim’s clipboard every few seconds, watching for strings that match the pattern of a Bitcoin, Ethereum, or Tron wallet address. When it spots one, it silently substitutes an address controlled by the attackers.

Because wallet addresses are long, random-looking strings that few people verify character by character before pasting, a victim moving funds to a friend, exchange, or vendor can end up sending money straight into the attacker’s wallet instead — and never notice until it’s too late.

• The swap happens instantly and silently, with no visible prompt or warning.
• Even a cautious user who double-checks and re-copies the correct address isn’t safe — the malware simply overwrites it again on its next polling cycle.
• The script additionally logs the visitor’s IP address, the referring site, and the specific page path, and phones that data home to an attacker-controlled server.

That last capability effectively gives the attackers a live map of how far the compromise has spread across the thousands of sites running the tainted script.

Clean Scans, Dirty Code

What makes this incident particularly unsettling is how well it evaded existing defenses. Every file, domain, and IP address tied to the campaign reportedly returned clean results when checked against mainstream antivirus engines and threat-intelligence platforms. Because the payload rode in on a script from an established, trusted advertising vendor, it slipped past the kind of third-party script filtering that many security tools rely on to catch exactly this sort of thing.

Indicators Worth Knowing

Beaumont’s research points to a specific beacon server communicating over a non-standard port, alongside a distinct compromised subdomain and script path used to deliver the payload, plus a unique file hash for the malicious script itself. Security teams running Adform’s tracking pixel should treat traffic to unfamiliar external IPs from their own web properties as a priority item to investigate.

Where Things Stand

As of this writing there’s no public confirmation that Adform has formally notified affected customers or issued a disclosure statement, though Beaumont has observed signs suggesting the malicious code is actively being stripped out — a sign that either Adform or the attackers themselves are aware the operation has been exposed.

For any organization using Adform’s services, security researchers recommend treating this as an active incident rather than a closed one: audit every third-party script loaded on your web properties, watch outbound traffic for connections to unfamiliar infrastructure, and rotate credentials that may have been exposed to compromised scripts during the window of compromise.

More broadly, the episode is a pointed reminder that the advertising and analytics scripts embedded on nearly every commercial website represent a trust relationship that’s rarely audited with the same rigor as a company’s own code — and attackers have clearly noticed.