Executive Summary
In July 2026, advertising technology provider Adform suffered a significant supply-chain compromise where its legitimate tracking script, `trackpoint-async.js`, was trojanized with malicious JavaScript. The incident, detected on July 27, impacted potentially thousands of downstream websites that integrate Adform's advertising and tracking services. The primary goal of the attack was the theft of cryptocurrency through clipboard hijacking and real-time DOM manipulation.
The malicious payload targeted Bitcoin, Ethereum, and TRON addresses. By modifying a shared resource, the attackers gained a massive distribution vector without needing to breach individual target websites. While Adform reported the incident was contained by late July, researchers observed activity for at least a week prior, and the cached nature of JavaScript libraries means some end-users may remain at risk until browser caches are cleared.
The tradecraft, including the use of blockchain-based C2 (EtherHiding) and social engineering techniques (ClickFix), has been linked to threat actors such as CountLoader and UNC5342. This attack highlights the persistent risk of third-party advertising scripts which often run with high privileges across a vast array of global web properties.