[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsXiml7Ag9M5DBilJSyoUxVdhllvUakSWDegVESvTvzw":3},{"article":4,"iocs":49,"watch_terms":62,"solutions":63,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"5ec3321b-423e-464b-b763-e0826c2d0264","Online ad firm Adform’s script compromised to steal cryptocurrency","online-ad-firm-adform-s-script-compromised-to-steal-cryptocurrency-93672d","Online advertising firm Adform suffered a supply-chain attack that delivered cryptocurrency-stealing scripts to websites using its ad platform, replacing wallet addresses copied to visitors' clipboards with ones controlled by an attacker. [...]","Online advertising firm Adform suffered a supply-chain attack where its JavaScript tracking script (trackpoint-async.js) was trojanzied to monitor and replace Bitcoin, Ethereum, and TRON wallet addresses in users' clipboards with attacker-controlled addresses. The malicious code, served from s2.adform.net and affecting all websites using Adform's platform, also communicated with an attacker server at 84.32.102.230:7744 to exfiltrate victim data. Adform removed the malicious code after discovery on July 27, 2026, though the attack had been active for approximately one week.","Adform's ad script compromised to steal cryptocurrency via clipboard replacement.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fonline-ad-firm-adforms-script-compromised-to-steal-cryptocurrency\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2023\u002F11\u002F15\u002FHacker_cryptocurrency_bitcoin.jpg","2026-07-31T21:09:25+00:00","2026-07-31T22:00:26.546232+00:00",9,[17,20,23,26],{"name":18,"type":19},"Adform","vendor",{"name":21,"type":22},"trackpoint-async.js","product",{"name":24,"type":25},"JavaScript","technology",{"name":27,"type":25},"Demand-Side Platform (DSP)","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":28,"icon":30,"name":31,"slug":32},null,"Supply Chain","supply-chain",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,58],{"type":51,"value":52,"context":53},"ip","84.32.102.230","Attacker-controlled C2 server receiving exfiltrated victim data (port 7744)",{"type":55,"value":56,"context":57},"domain","s2.adform.net","Adform CDN domain serving trojanzied trackpoint-async.js script",{"type":59,"value":60,"context":61},"url","https:\u002F\u002Fs2.adform.net\u002Ftrackpoint-async.js","Trojanzied Adform tracking script with clipboard-hijacking payload",[18,21],{"controls":64,"vendors":150},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":95,"name":96,"problem":97,"products":98},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":124,"name":125,"problem":126,"products":127},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[128,134,142],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":129,"product_name":130,"url":132,"description":133},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[],{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":167},"adforms-trojanized-ad-script-hijacks-crypto-wallet-addresses-in-supply-chain-attack","Adform's Trojanized Ad Script Hijacks Crypto Wallet Addresses in Supply-Chain Attack","Attackers compromised Adform's widely-distributed JavaScript tracking script, injecting malicious code that silently replaced cryptocurrency wallet addresses in users' clipboards with attacker-controlled ones — a classic clipboard hijacking technique. Because the script was served centrally from Adform's CDN, every website relying on the platform became an unwitting attack vector, amplifying the blast radius far beyond a single organization. The attack persisted for approximately one week before discovery, highlighting a critical gap in monitoring the integrity of third-party scripts. This incident underscores the inherent trust risk in third-party JavaScript dependencies: a single compromised vendor can instantly weaponize thousands of downstream sites against their users. Organizations that embed external scripts without integrity controls effectively surrender a portion of their security posture to that vendor.",[156,157,158,159,160,161,162,163,164,165,166],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 13: Network Monitoring and Defense","NIST SP 800-161: Supply Chain Risk Management Practices","NIST CSF DE.CM-3: Personnel activity is monitored to detect cybersecurity events","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","OWASP A08:2021 – Software and Data Integrity Failures","W3C Subresource Integrity (SRI) Specification","GDPR Article 32: Security of Processing (breach via third-party processor)","GDPR Article 28: Processor obligations and vendor due diligence","ITIL: Supplier Management Practice",{}]