Online ad firm Adform’s script compromised to steal cryptocurrency

Attackers compromised Adform's widely-distributed JavaScript tracking script, injecting malicious code that silently replaced cryptocurrency wallet addresses in users' clipboards with attacker-controlled ones — a classic clipboard hijacking technique. Because the script was served centrally from Adform's CDN, every website relying on the platform became an unwitting attack vector, amplifying the blast radius far beyond a single organization. The attack persisted for approximately one week before discovery, highlighting a critical gap in monitoring the integrity of third-party scripts. This incident underscores the inherent trust risk in third-party JavaScript dependencies: a single compromised vendor can instantly weaponize thousands of downstream sites against their users. Organizations that embed external scripts without integrity controls effectively surrender a portion of their security posture to that vendor.