Adform Supply-Chain Script Compromise – Cryptocurrency Clipboard Hijacking

Technical Analysis

The attack exploited a supply-chain trust relationship in which a widely embedded third-party JavaScript file, served by Adform across numerous customer websites, was modified to include a clipboard-hijacking payload commonly referred to as a 'crypto-clipper.' This technique detects when a user copies a string matching cryptocurrency wallet address patterns (e.g., regex matches for Bitcoin, Ethereum formats) and silently substitutes it with an attacker-controlled address before paste, redirecting subsequent transactions without requiring further user interaction. Because the script was served from a trusted ad-tech CDN embedded across many unrelated sites, the blast radius extended far beyond a single organization, illustrating classic third-party script supply-chain risk in web advertising ecosystems. No CVE has been assigned as this is a compromise of Adform's content delivery/build pipeline rather than a software vulnerability in a specific product version. For organizations running AI agents or browser-automation tooling that interact with web pages containing ad-tech scripts (e.g., agents that scrape, browse, or perform financial transactions via clipboard operations), this incident highlights a risk vector where agent-driven clipboard reads/writes on compromised pages could result in silent transaction tampering, warranting inclusion of clipboard-integrity checks in agent browsing workflows.

Affected Systems

Websites and applications embedding the compromised Adform JavaScript ad-serving script; end-user browsers visiting affected sites on or around July 27, 2026; any downstream systems or agents that programmatically read/write clipboard content on affected pages.

Indicators of Compromise

• Malicious JavaScript payload served via Adform ad-serving infrastructure (specific file hash not disclosed in source)
• Attacker-controlled cryptocurrency wallet addresses (not disclosed in source)
• Affected time window: July 27, 2026

Remediation Steps

1. 1

   Audit third-party script inclusions

   Review all sites embedding Adform or other third-party ad-tech scripts to confirm removal of malicious code and validate current script integrity via subresource integrity (SRI) hashes.

2. 2

   Notify and warn affected users

   Alert any users who visited impacted sites on July 27, 2026 and may have copied a cryptocurrency wallet address, advising them to verify recent transactions and treat any funds sent during that window as potentially compromised.

3. 3

   Implement Content Security Policy and SRI

   Enforce CSP restrictions on third-party script execution and use Subresource Integrity tags for all externally loaded scripts to prevent silent tampering.

4. 4

   Monitor clipboard-interaction code paths

   For any automation, browser extensions, or AI agents that interact with clipboard data on third-party-scripted pages, add validation checks comparing copied and pasted wallet address strings to detect substitution.

5. 5

   Engage incident response and law enforcement

   Coordinate with Adform, affected customers, and relevant authorities to trace stolen funds and support any ongoing investigation.