A compromised JavaScript file distributed by advertising technology company Adform was modified to replace cryptocurrency wallet addresses displayed, copied or entered on customer websites. The attack transformed a widely deployed tracking component into a browser-based theft mechanism capable of redirecting payments without installing conventional malware.
A Supply-Chain Attack Inside the Browser
The affected resource, identified as trackpoint-async.js, was served from Adform infrastructure and could be deployed across individual pages, website sections or entire sites. Attackers appended malicious code to the legitimate library, allowing the compromise to reach downstream websites that trusted and loaded the shared script.
The injected code searched for Bitcoin, Ethereum and Tron addresses. It monitored clipboard activity and attempted to replace copied wallet addresses with attacker-controlled alternatives. More concerningly, it could also rewrite text within input fields, text areas and editable page elements. A victim might notice an incorrect address and paste the intended one again, only for the script to replace it repeatedly while the page remained open.
Adform detected the incident on July 27, removed the malicious code, notified customers and reported the compromise to authorities. However, cached copies may have remained in users' browsers after the server-side correction. Adform therefore advised users to clear their browser caches and verify cryptocurrency addresses before approving transactions.
Important Questions Remain
The publicly known scope remains incomplete. Adform has not disclosed how attackers gained access to the deployment process, how many websites loaded the altered file, how many visitors encountered it or whether cryptocurrency was successfully diverted. Researchers also observed code capable of sending page information to an external server, although confirmed data transmission has not been established.
Reducing Third-Party Script Risk
- Maintain an inventory of externally hosted scripts and their business owners.
- Use Content Security Policy rules to restrict network destinations.
- Apply Subresource Integrity where scripts have predictable versions.
- Monitor third-party JavaScript for unexpected changes.
- Require independent wallet-address verification before high-value transfers.
I believe organizations still underestimate browser-side supply-chain exposure. A trusted script executes with access to the page and its users, making it part of the application's effective security boundary. Advertising and analytics components should therefore be governed with the same care as production software dependencies. Trusting a provider should never mean surrendering visibility into what its code is doing inside customer sessions.
([thehackernews.com](https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html))