How a Single Tracking Script Redirected Crypto Payments Across the Web

Ad technology is the dark matter of the modern internet. It is invisible to the average user, yet it exerts a massive influence on how data flows across the web. When this invisible layer fails, the impact scales instantly across thousands of unrelated websites. On July 27, 2026, Adform discovered that one of its primary tracking scripts had been turned against its users. A supply-chain compromise allowed attackers to inject malicious code into a widely used JavaScript file, transforming it into a tool that rewrites cryptocurrency wallet addresses in real time.

I spent my morning analyzing the captured samples of the malicious script. The compromise targets trackpoint-async.js, a file served from Adform's infrastructure. Because this script is integrated into the headers of roughly 1,800 customer sites to facilitate advertising analytics, the attackers did not need to breach those individual companies. They simply poisoned the well. Once the altered script loaded in a visitor's browser, it began monitoring the document object model for specific patterns that look like Bitcoin, Ethereum, or Tron addresses.

The invisible risk of third party dependencies

Modern web architecture relies on the implicit trust of third-party resources. When a developer adds a line of code to call a script from a global provider, they grant that provider significant control over the user experience. This incident is a textbook example of a supply-chain attack where the trust relationship is exploited. The script in question, trackpoint-async.js, is designed to run across entire websites or specific sections. In this case, the attackers appended two malicious blocks of code to the end of the legitimate library.

From a risk perspective, this is a nightmare scenario for any site administrator. You can have a perfect security posture, a hardened server, and a rigorous internal code review process, yet a single external script can still compromise your users. The attackers bypassed the network perimeter by going through a side door that is almost always left open for marketing and analytics tools. This demonstrates why the concept of a network perimeter is an obsolete castle moat. If you allow external scripts to run with high privileges on your site, you have effectively invited a stranger to manage your security.

Anatomy of the trackpoint compromise

Technical analysis of the malicious blocks reveals a focused effort to hijack financial transactions. The code uses a six-byte XOR key to obfuscate the replacement wallet addresses, a common tactic to evade basic signature-based detection. Once the script executes, it initiates two distinct attack paths. The first block focuses on the system clipboard. It watches for the copy event and attempts to read the clipboard every four seconds. If it identifies a string that matches a cryptocurrency wallet pattern, it replaces that string with a wallet address owned by the attacker.

Behind the scenes, the second block of code is even more invasive. It walks through the text nodes of the document and monitors every input field, textarea, and contenteditable element. When a user types or pastes an address into a form field, the script intercepts the event and rewrites the value. It even goes so far as to restore the cursor position after the rewrite to ensure the user does not notice the shift. This level of granular manipulation ensures that even if a user bypasses the clipboard by typing an address manually, the transaction remains vulnerable to redirection.

The clipboard is a contested environment

Independent researcher Kevin Beaumont noted a particularly aggressive trait of this malware. Even if a user notices that the address is incorrect and attempts to copy the original wallet address again, the script continues to replace it. This persistence makes the browser environment itself untrustworthy. In the event of a breach like this, the browser becomes a malicious agent acting against the interests of the user.

From an end-user perspective, the attack is almost entirely silent. There are no pop-ups, no slowdowns, and no obvious signs of system infection. The malware does not attempt to install software or establish persistence on the hard drive. It exists only in the volatile memory of the browser tab. Once the user closes the affected page, the malicious process ends. However, the damage occurs in the seconds it takes to click a send button. One altered address at the point of payment is enough to redirect thousands of dollars in a way that is functionally irreversible on a decentralized blockchain.

Reconciling the timeline conflict

There is a discrepancy between the official incident report and independent observations. Adform identifies July 27 as the date of the incident and states they removed the code promptly. Kevin Beaumont reported seeing malicious activity via Adform for at least a week prior to that date. This duration gap is a significant problem for risk assessment. If the script was active for seven days instead of one, the number of exposed visitors increases by orders of magnitude. Adform serves roughly 1.5 billion ads daily across 180 countries. Even if only a small fraction of those ads carried the malicious payload, the potential victim pool is enormous.

As a countermeasure, Adform has advised all users to clear their browser cache. This is a vital step because the malicious version of trackpoint-async.js may remain stored locally on a user's computer even after the server-side fix. If the browser loads the cached version of the script, the attack remains active. This highlights a persistent flaw in web security where the longevity of a cache can extend the life of a security threat long after a patch is deployed.

Assessing the exfiltration capabilities

One of the more concerning aspects of the code is its communication with an external server. The script attempts to send an HTTP request to an IP address (84.32.102[.]230) on page load. This request includes the hostname and the specific path of the page the visitor is currently viewing. Adform stated that they found no evidence that visitors' IP addresses or browsing history reached the attackers. However, the incident notice admits that such transmission was technically possible based on the code's construction.

In my experience analyzing APTs and supply-chain breaches, attackers rarely include data exfiltration capabilities without the intent to use them. The hostname and path data provide the operators with a live map of which sites are successfully serving their malware. This helps them prioritize their targets and measure the effectiveness of their compromise. Proactively speaking, we must assume that any data the script could access was potentially recorded by the attacker's command-and-control server.

Defensive measures for the modern web

This incident serves as a sharp reminder that third-party scripts are a major vector for systemic risk. To defend against this, organizations must move toward a granular security model. Using Subresource Integrity (SRI) hashes is a primary defense. SRI allows a browser to verify that a fetched script has not been manipulated. If the hash of the file on the server does not match the hash defined in the website's code, the browser refuses to execute it. If Adform's clients had implemented SRI for trackpoint-async.js, the malicious version would have been blocked automatically.

Another critical defense is the Content Security Policy (CSP). A well-configured CSP can restrict the domains from which scripts can be loaded and prevent them from sending data to unauthorized external IP addresses. If a CSP had been in place that explicitly blocked connections to the attacker's IP address, the data exfiltration attempt would have failed. Security is not a single tool but a series of overlapping layers. When one layer is compromised, the others must be ready to catch the failure.

Ultimately, the responsibility for verifying a transaction remains with the user. The most effective defense in this specific case is the simplest: always verify the destination address through a second channel or by double-checking every character before hitting send. In a world where the very code you use to browse the web can turn against you, healthy paranoia is a functional requirement for digital life.

Key Takeaways for IT Leaders

• Audit all third-party scripts currently running on your production environments and remove any that are not mission-critical.
• Implement Subresource Integrity hashes for all external JavaScript dependencies to prevent unauthorized code execution.
• Strengthen Content Security Policies to restrict script execution and data exfiltration to known, trusted domains.
• Enforce a zero-trust approach to client-side resources by assuming that any external dependency can be compromised at the source.

Sources

• Adform Incident Notice (July 2026)
• MITRE ATT&CK Framework: Supply Chain Compromise (T1195)
• NIST Special Publication 800-161: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Disclaimer: This article is for informational and educational purposes only and does not replace a professional cybersecurity audit or incident response service.