Adform Ad Platform Compromised to Deploy Cryptocurrency Clipboard Hijacker

What Happened

According to BleepingComputer, online advertising firm Adform suffered a supply-chain attack in which its ad-serving script was compromised to deliver cryptocurrency-stealing code to websites that embed its ad platform. The malicious script reportedly monitors visitors' clipboards and replaces copied cryptocurrency wallet addresses with attacker-controlled addresses — a technique commonly known as "clipboard hijacking" or "address poisoning."

Why It Matters

Because Adform's script is loaded by third-party websites to serve ads, this is a classic supply-chain compromise: a single trusted vendor script running in visitor browsers can silently affect every site that embeds it, without those site operators changing anything themselves. Visitors attempting to copy and paste cryptocurrency wallet addresses on affected pages are at risk of having funds redirected to an attacker's wallet, and site owners may be unaware their pages are serving malicious content.

What Defenders Should Watch For

• Inventory and monitor third-party ad and analytics scripts loaded on your web properties, particularly any originating from Adform, and watch for unexpected changes in script content or behavior.
• Consider Subresource Integrity (SRI) and Content Security Policy (CSP) controls to limit what third-party scripts can do on your pages, including restricting clipboard API access where feasible.
• For SOC/threat-hunting teams, look for anomalous clipboard.writeText/clipboard-event usage in browser telemetry or EDR-for-browser tooling on pages that load ad-network scripts.
• Advise users and finance/crypto-handling staff to always visually verify wallet addresses before sending funds, rather than trusting a pasted value.
• Site operators using Adform should monitor vendor communications for confirmation and remediation guidance, and review outbound network activity from affected pages.

Developing Story

This is a net-new report and details such as the scope of affected sites, duration of compromise, and attribution remain unconfirmed as of publication. We will continue to monitor for updates. Read the original report at BleepingComputer.