Adform Supply Chain Attack Delivers Crypto Stealer

Key Takeaways

• A malicious JavaScript file (trackpoint‑async.js) was served through the legitimate advertising network Adform, despite appearing clean on VirusTotal scans.
• The script continuously monitors the user’s clipboard for cryptocurrency wallet addresses (Bitcoin, Ethereum, TRON) and silently replaces them with attacker‑controlled addresses.
• The replacement occurs via a polling loop that runs every three seconds, ensuring that even if a user notices the altered address and re‑copies it, the malicious code will overwrite it again.
• In addition to clipboard hijacking, the script beacons to an attacker‑controlled server (84.32.102.230:7744), transmitting the victim’s IP address, referring website, and the URL path where the ad was loaded.
• The compromise represents a supply‑chain attack: the malicious payload was injected into a trusted third‑party resource, allowing it to reach a broad audience without triggering traditional file‑based detection.
• The malicious code appeared to be removed or altered in real time as the researcher published findings, suggesting the threat actors are actively monitoring detection efforts.
• Security teams should monitor network traffic to the identified beacon IP, inspect third‑party JavaScript served by ad platforms for unexpected behavior, and consider implementing clipboard‑integrity controls or user‑education about verifying crypto addresses before transactions.

Overview of the Incident
The incident came to light when a security researcher examined a JavaScript file named trackpoint‑async.js that was being delivered via the Adform advertising network. Although VirusTotal reported the file as clean—showing no malicious hits across URLs, files, domains, or IP addresses—the actual content served to end users contained hidden malicious functionality. This discrepancy highlights a limitation of static file‑hash reputation checks when the payload is delivered dynamically or altered after the initial scan. The researcher observed the malicious behavior in real time and documented how the script interfered with cryptocurrency transactions by manipulating clipboard data.

Technical Details of the Malicious Script
At the core of the attack is a function that periodically checks the system clipboard for strings matching known cryptocurrency address formats—specifically Bitcoin, Ethereum, and TRON wallets. When a match is found, the script overwrites the clipboard contents with an address controlled by the attacker. The replacement is not a one‑time swap; instead, the script operates inside a setInterval loop that executes every three seconds, ensuring that any user‑initiated correction (e.g., re‑copying the original address) is promptly reverted. This persistent polling mechanism makes the attack highly resilient to casual user vigilance.

Clipboard Hijacking Mechanics
The script employs regular expressions or similar pattern‑matching techniques to identify wallet addresses. Once identified, it assigns the attacker’s address to navigator.clipboard.writeText() (or the legacy clipboardData API, depending on the browser). Because the operation occurs in the background without user interaction, victims typically remain unaware that the address they intend to send funds to has been altered. The attacker’s wallets appear to vary across infections, likely to avoid simple block‑list defenses and to distribute the stolen funds across multiple destinations.

Persistence Through Polling
By setting a polling interval of 3000 milliseconds, the script guarantees continuous monitoring. Even if a user detects an incorrect address, manually corrects it, and attempts to paste the proper wallet, the next poll—occurring within a few seconds—will overwrite the clipboard again. This loop effectively neutralizes manual mitigation attempts unless the user disables JavaScript, closes the page, or employs a clipboard‑protection tool that blocks silent writes. The attacker’s reliance on a short interval balances stealth (avoiding excessive CPU usage) with effectiveness (maintaining control over the clipboard).

Exfiltration and Telemetry
Beyond address swapping, the script collects additional telemetry from the victim’s browser and sends it to an attacker‑controlled beacon. Each beacon request includes the victim’s public IP address, the referring website (indicating which site loaded the malicious ad), and the specific URL path where the ad was displayed. An example request observed by the researcher resembled:
hxxp://84.32.102.230:7744/p?h=example.com&u=/test
The beacon server resides at IP address 84.32.102.230 on port 7744. This data enables the attacker to profile victims, assess the reach of the malicious ad campaign, and potentially tailor further attacks based on geographic or referral information.

Supply‑Chain Nature of the Compromise
The malicious payload was not hosted on a suspicious domain but was delivered through Adform, a legitimate and widely used advertising platform. This represents a classic supply‑chain attack: the threat actor compromised (or otherwise influenced) a trusted third‑party resource, allowing the malicious code to piggyback on legitimate ad impressions. Because the file’s hash appeared clean on VirusTotal at the time of scanning, traditional reputation‑based defenses failed to flag it, underscoring the need for behavior‑based monitoring and runtime inspection of third‑party scripts.

Evidence of Active Evasion
During the researcher’s documentation process, the malicious code appeared to be disappearing or being altered in real time. The observer noted that the script served by Adform was changing as they wrote the report, suggesting the attacker is actively monitoring detection efforts and may be pulling back or modifying the payload to evade analysis. This cat‑and‑mouse behavior indicates a sophisticated operation capable of rapid response to threat intelligence, making static indicators of compromise (IOCs) short‑lived and necessitating continuous threat‑hunting practices.

Full Script Example for Reverse Engineers
For those interested in deeper analysis, the researcher provided a link to a Pastebin entry containing the full script as served by Adform: https://pastebin.com/mc7psaNF. The snippet also references the beacon domain beacons2.adform.net and the original script URL https://s2.adform.net/banners/scripts/st/trackpoint-async.js. Analysts can use this sample to examine the exact obfuscation techniques, identify the address‑matching regex patterns, and understand the networking logic used for exfiltration.

Detection and Mitigation Recommendations
Organizations should consider several layers of defense against this type of threat:

1. Network‑level Monitoring – Create alerts for outbound connections to 84.32.102.230:7744 or any unexpected beacon endpoints, especially those using non‑standard ports.
2. Web‑Traffic Inspection – Deploy solutions that can inspect and validate third‑party JavaScript served by ad networks, looking for clipboard‑write APIs (navigator.clipboard.writeText, document.execCommand('copy'), etc.) and periodic timer functions (setInterval, setTimeout).
3. Endpoint Controls – Implement clipboard‑protection tools that prompt or log any programmatic clipboard modifications, or restrict write access to the clipboard for unsigned scripts.
4. User Education – Advise users, particularly those handling cryptocurrency, to always verify wallet addresses before confirming a transaction—preferably by comparing the address against a trusted source or using a hardware wallet’s display.
5. Ad‑Network Vigilance – Work with advertising partners to enforce strict content security policies (CSP), subresource integrity (SRI) checks, and sandboxing of third‑party scripts to limit their ability to interact with the clipboard or network.

Conclusion
The case of the compromised trackpoint-async.js file demonstrates how attackers can abuse trusted advertising infrastructures to conduct clipboard‑based cryptocurrency theft. By combining persistent clipboard hijacking with telemetry exfiltration, the threat actors were able to siphon funds while remaining largely invisible to conventional signature‑based scanners. The real‑time disappearance of the malicious payload underscores the need for adaptive, behavior‑focused defenses and close collaboration between security teams, ad platforms, and end users to safeguard against similar supply‑chain compromises in the future.