Ad Platform Hack Turned Business Websites Into Crypto Stealers

European ad tech firm Adform confirmed last week that attackers compromised its JavaScript tracking script, injecting code that silently swapped cryptocurrency wallet addresses in visitors’ clipboards with attacker-controlled ones. Every website embedding Adform’s ad platform — and there are thousands — was unknowingly serving crypto-stealing malware to visitors for at least a week before the breach was detected on 27 July.

Security researcher Kevin Beaumont traced the attack to trackpoint-async.js, Adform’s standard tracking script loaded from s2.adform.net. Attackers appended obfuscated code to the legitimate library. The payload scanned the clipboard every few seconds, detected Bitcoin, Ethereum and Tron wallet addresses, and replaced them with the attacker’s. It could also rewrite wallet addresses displayed on web pages — so even if a visitor double-checked the address on screen, it was already swapped.

Why This Matters for Australian Businesses

This is a textbook supply-chain attack. The victim websites didn’t get hacked — a trusted third-party script they’d embedded did. And that’s the risk most Australian SMBs aren’t thinking about.

When we audit client websites at All IT, we typically find 15–20 external scripts running — ad tags, analytics tools, chat widgets, social embeds, remarketing pixels — and the business owner can usually name three or four of them. Marketing teams add tracking scripts without IT sign-off. Nobody reviews what those scripts actually do once they’re live, and nobody monitors them for changes after installation.

Every one of those scripts has the same level of access to your visitors’ browsers as your own site code. If one gets compromised upstream, it can read form inputs, steal clipboard data, inject content, or redirect users. Your visitors won’t see anything wrong — and neither will you, unless you’re actively watching.

What to Do

Start by auditing the external scripts running on your business website. Open your site in Chrome, press F12, select the Sources tab, and look at every domain loading JavaScript. If you can’t explain why a script is there, find out or remove it.

Ask your web developer to implement a Content Security Policy (CSP) header, which restricts which external domains can execute scripts on your pages. If your marketing team adds tracking or ad scripts, make sure IT reviews them first. This isn’t about slowing marketing down — it’s about knowing what code runs on your business website and who controls it.

All IT helps businesses across Sydney, the Central West, and Brisbane audit their web presence and lock down third-party script risks as part of our managed IT support. If you haven’t reviewed what’s running on your site lately, that’s a practical starting point. Get in touch.