Adform Ad Script Hijacked in Supply-Chain Crypto Attack

Adform, an online advertising platform used by publishers worldwide, disclosed that its JavaScript ad delivery script was compromised in a supply-chain attack. The malicious code performed clipboard hijacking: when a visitor on an affected site copied a cryptocurrency wallet address, the script silently replaced it with one controlled by the attacker before the user could paste it. The transfer goes to the wrong wallet. Victims typically don’t realize what happened until the transaction is confirmed and the funds are gone.

The mechanism is well-understood and brutal in practice. Clipboard monitoring requires minimal JavaScript, runs without any visible UI change, and targets the exact moment a user is about to make a financial transaction. Adform’s script was served directly from the ad platform’s infrastructure, so any publisher embedding its ad tag was unknowingly distributing the payload to their visitors.

BleepingComputer first reported the compromise on July 31, 2026.

What to do if your site runs Adform

This is not a theoretical risk. If your site served Adform’s tag during the compromise window, your users were exposed.

Immediate steps:

1. Confirm whether you use Adform. Check your ad network contracts, header bidding stack, and any third-party ad management platforms. If Adform appears anywhere in your JavaScript call chain, assume you were affected.

2. Check Adform’s advisory channel. Monitor Adform’s status page and security communications for confirmation that the malicious version has been pulled and a clean script is live. Do not re-enable their tag until you have that confirmation.

3. Identify your exposure window. Pull your CDN or server logs to determine when the compromised script was first served on your site. That window matters for any user notification decision.

4. Notify affected users. If your site serves a crypto-adjacent audience — exchanges, DeFi platforms, wallets, fintech — notify them that they may have had wallet addresses modified during this window. Direct them to verify any recent transaction destinations before sending funds.

Structural fixes for ad infrastructure

This attack is a reminder that third-party ad scripts are among the least-audited code on most publisher sites. They load dynamically, often from multiple chained vendors, and most sites have no mechanism to detect unexpected behavior changes.

Some options that reduce (but don’t eliminate) the attack surface:

• Content Security Policy with script-src combined with Subresource Integrity (SRI) hashes can block unexpected script modifications — but ad delivery pipelines often require dynamic script loading that breaks strict SRI enforcement. It’s worth the conversation with your ad ops team even if you can’t fully implement it.
• Third-party script sandboxing via iframe-isolated ad slots limits what scripts can access outside the ad container. Again, not universally compatible, but worth the tradeoff for high-value publisher sites.
• Periodic ad script audits — automated or manual — against known-good baselines can catch unauthorized additions. Most teams skip this entirely.

The honest priority call: if you’re not in the crypto or fintech space and didn’t serve Adform ads, this one is informational. If you did serve Adform ads, user notification and a forensic log review aren’t optional.

Pattern context

This is the third notable JavaScript supply-chain compromise to affect publisher or developer infrastructure in July alone. The jscrambler npm hijack buried a Rust infostealer in a preinstall hook targeting developer environments. The Joyfill npm packages hid DEV#POPPER RAT behind a beta package that fired on import. Last week, Amazon attributed the debug and chalk npm hijack to North Korea’s Sapphire Sleet — a September 2025 incident whose attribution had been pending for ten months.

The distribution model is the same in each case: compromise something trusted, get free delivery through every downstream user and visitor. The Adform case extends that pattern into ad delivery infrastructure, which has a much larger passive footprint than developer tooling. Publishers don’t run ad scripts — they serve them to millions of visitors who have no idea what code an ad tag might execute.