Adform ad script hijacked to steal crypto wallet addresses from site visitors
A compromised JavaScript tracking file served by adtech platform Adform was injecting code that monitors clipboard and replaces Bitcoin, Ethereum or TRON addresses with an attacker‑controlled wallet. The supply‑chain attack briefly affected any website using Adform’s trackpoint‑async.js, forcing visitors to unknowingly send payments to the thief; Adform removed the code and warned clients to clear cookies.