Platform Turned Into a Crypto‑Stealer

Overview

A major supply chain compromise has struck Adform, one of the largest advertising technology companies serving over 14,000 businesses and controlling nearly 30% of the demand‑side platform market. Attackers hijacked a widely used JavaScript tracking script hosted on Adform’s domain, transforming trusted ad infrastructure into a crypto‑stealer malware delivery network.

How the Attack Worked

• Compromised script: The malicious code was injected into Adform’s trackpoint-async.js file, embedded across thousands of client websites.
• Clipboard hijacker: The malware continuously scanned users’ clipboards for cryptocurrency wallet addresses (Bitcoin, Ethereum, Tron).
• Silent replacement: Legitimate wallet addresses were swapped for attacker‑controlled ones, redirecting funds.
• Persistence: Even if users recopied the correct address, the malware overwrote it again within seconds.

Surveillance & Data Exfiltration

Beyond financial theft, the script acted as a surveillance tool:

• Logged victims’ IP addresses, originating websites, and URL paths.
• Sent data to an attacker‑controlled C2 server over port 7744.
• Helped attackers map infection spread across affected sites.

Why It Evaded Detection

• Trusted infrastructure: The malicious code was served from Adform’s legitimate domain (s2.adform.net).
• Clean scans: Major antivirus and threat intelligence platforms flagged the file as safe.
• Supply chain leverage: By poisoning one script, attackers reached millions of end users across downstream websites.

Indicators of Compromise (IoCs)

• Domain: s2.adform[.]net (compromised subdomain).
• Malicious script URL: hxxps://s2[.]adform.net/banners/scripts/st/trackpoint-async.js.
• C2 IP: 84.32.102[.]230:7744.
• Payload hash (SHA‑256): 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55.
• Beacon pattern: hxxp://84.32.102[.]230:7744/p?h=<domain>&u=<path>.

Defensive Guidance

For organizations using Adform services:

• Audit third‑party scripts immediately.
• Monitor outbound traffic to attacker infrastructure.
• Rotate exposed credentials.
• Implement script integrity checks (Subresource Integrity, CSP).
• Stay vigilant for signs of clipboard hijacking and suspicious persistence.

Expert in the Cloud Insight

This incident is a textbook supply chain attack: attackers poisoned one trusted file to reach millions. It highlights the fragility of third‑party dependencies in modern web ecosystems. For defenders, the lesson is clear: trust must be verified continuously. Monitoring script integrity and outbound traffic is no longer optional — it’s essential to protect against stealthy compromises hidden inside legitimate infrastructure.