Adform is not a household name, but its script probably runs on sites you visit daily. The Copenhagen-based ad technology company, Europe’s first pan-European demand-side platform, serves roughly 14,000 advertisers and publishers and holds close to a third of the DSP market. For about a week ending in late July 2026, every one of those sites was quietly serving cryptocurrency-stealing code to its visitors, and none of them had to do anything wrong for that to happen.

A tracking script became a wallet swapper

The compromise sat in trackpoint-async.js, Adform’s JavaScript tracking library, served from s2.adform.net and embedded directly into the pages of every site running Adform’s ad platform. Security researcher Kevin Beaumont identified the malicious behaviour: the script continuously monitored what visitors copied to their clipboard, and whenever it detected something resembling a Bitcoin, Ethereum, or TRON wallet address, it silently replaced it with an address controlled by the attacker. The substitution ran on a three-second loop, so even a visitor who noticed the address looked wrong and copied it again received the same swapped result moments later.

Anyone who copies a crypto address rarely reads all of it back before pasting into a wallet or exchange. That is precisely the behaviour clipboard-hijacking malware is built around, and running it through a tracking script embedded on thousands of unrelated, otherwise trustworthy websites gave it a distribution footprint that a standalone piece of malware could never achieve on its own.

The part that should concern every site owner

None of the affected publishers or advertisers wrote insecure code, misconfigured a server, or made a mistake that let this in. They embedded a third-party script from an established, reputable vendor, the same category of dependency that sits on nearly every commercial website in the form of analytics, ad tech, chat widgets, and tag managers. That script’s supply chain was compromised upstream, and the malicious payload rode along automatically to every site that trusted it, with no further action required from any of them.

This is the same failure class behind a string of incidents we have covered through 2026, from compromised npm and RubyGems packages reaching developer machines to CI/CD credentials being the real target rather than source code itself. What makes the Adform case distinct is that the payload landed directly in front of end users on live production sites, not in a build pipeline where a security team might catch it before release.

What actually reduces this risk

Subresource Integrity hashes on third-party scripts are the most direct mitigation, since a compromised script that no longer matches its expected hash simply fails to load rather than executing silently. A Content Security Policy that restricts script-src to a known allowlist limits how much damage an already-loaded third party can do. Beyond the technical controls, this is also a vendor risk management problem: any third-party script running unmodified in your users’ browsers is effectively part of your own attack surface, and it is worth knowing which of your vendors’ scripts run with that level of trust and whether any of them are pinned, monitored, or reviewed at all.

If your organisation embeds third-party ad, analytics, or tracking scripts and needs a review of your Subresource Integrity and Content Security Policy coverage, or a broader audit of which vendor scripts run unchecked on your production sites, contact Excello Digital. We help European organisations find the third-party trust relationships nobody has looked at since the day they were added.