Adform, an online advertising technology company whose scripts are embedded across a large number of customer websites, confirmed on July 27, 2026 that a shared JavaScript file it serves, trackpoint-async.js, was compromised and modified to interfere with cryptocurrency transactions on any site that loads it.
According to Adform’s own incident notice, the injected code monitored a visitor’s clipboard for Bitcoin, Ethereum, or Tron wallet address strings and swapped in an attacker-controlled address, and could also rewrite wallet addresses displayed directly on a page. Adform said the code “operated only while an affected webpage was open” and found no evidence it transmitted visitors’ IP addresses or browsing history to an outside party, though it acknowledged such transmission was technically possible. The company removed the malicious code, reported the incident to authorities, and is advising affected visitors to clear their browser cache and verify any wallet address before sending funds.
The mechanics matter more than the cryptocurrency angle. Adform’s script is a shared dependency loaded by websites that never touched Adform’s own infrastructure directly, so compromising one deployment path gave the attacker reach into every site pulling that file: the same one-to-many amplification that makes any third-party script, analytics tag, or ad-tech pixel a supply-chain risk regardless of what payload it happens to carry this time. CyberTech has covered how package registries are adding friction to slow exactly this kind of trusted-dependency abuse in build pipelines; the Adform incident is a reminder that the same exposure sits in the browser supply chain too, and third-party script inventories deserve the same scrutiny as software dependencies.
Source: Adform Security Incident Update
