Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites

Attackers compromised the JavaScript file 'trackpoint-async.js' served by Adform from s2.adform[.]net, injecting two malicious blocks appended to the legitimate library. The malicious code functions as a browser-side crypto clipper/address swapper. The first block monitors copy events, polls the clipboard every four seconds, and replaces detected cryptocurrency wallet addresses (Bitcoin, Ethereum, Tron) with attacker-controlled addresses. The second block walks the DOM's text nodes, rewrites values in input, textarea, and contenteditable elements (restoring cursor position after rewrite), and hooks the value setter on input and textarea elements so programmatic writes are also intercepted and rewritten. The script intercepts copy, cut, paste, and input events. Replacement wallet address strings are obfuscated using a six-byte XOR key. On page load, the first payload sends an HTTP request to 84.32.102[.]230:7744 containing the hostname and path of the visited page. The code operated only while the affected page was open, with no persistence mechanism. Because trackpoint-async.js is a shared resource that can be deployed across entire websites, compromising it gave attackers a supply-chain route into all downstream customer sites. The attack was active on July 27, 2026, though researcher Kevin Beaumont observed malicious activity spanning approximately a week. No VirusTotal detections were recorded for the file or associated infrastructure at the time of disclosure.