--- title: Online ad firm Adform’s script compromised to steal... description: Online adtech firm Adform suffered a supply-chain attack on July 27, 2026, when its JavaScript tracking script 'trackpoint-async.js' was trojanized to steal... canonical: https://daily.dev/posts/online-ad-firm-adform-s-script-compromised-to-steal-cryptocurrency-xskl8wnse twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Online ad firm Adform’s script compromised to steal cryptocurrency | daily.dev og:description: Online adtech firm Adform suffered a supply-chain attack on July 27, 2026, when its JavaScript tracking script 'trackpoint-async.js' was trojanized to steal... og:url: https://daily.dev/posts/online-ad-firm-adform-s-script-compromised-to-steal-cryptocurrency-xskl8wnse og:image: https://api.daily.dev/og/posts/XskL8wnse.png og:image:alt: Online ad firm Adform’s script compromised to steal cryptocurrency og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Online ad firm Adform’s script compromised to steal cryptocurrency **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Online adtech firm Adform suffered a supply-chain attack on July 27, 2026, when its JavaScript tracking script 'trackpoint-async.js' was trojanized to steal cryptocurrency. The malicious code monitored visitors' clipboards on any website embedding the Adform script, replacing Bitcoin, Ethereum, and TRON wallet addresses with attacker-controlled ones. It also rewrote wallet addresses displayed on web pages and communicated victim data to an attacker-controlled server. Security researcher Kevin Beaumont discovered the attack; the malicious code evaded all VirusTotal antivirus engines. Adform removed the malicious code shortly after discovery and states the code did not install persistent software. Users who visited affected sites on July 27 are advised to clear browser cookies. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Malicious sites use JavaScript to build malware in browser memory](https://daily.dev/posts/malicious-sites-use-javascript-to-build-malware-in-browser-memory-cxvd9qsnl) · BleepingComputer · 1 upvotes · 0 comments - [Crypto Heist Fueled by Elaborate Fake Reputation Campaign](https://daily.dev/posts/crypto-heist-fueled-by-elaborate-fake-reputation-campaign-jl8cj7yzf) · Dark Reading · 1 upvotes · 0 comments - [Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites](https://daily.dev/posts/hackers-abuse-blockchain-smart-contracts-to-spread-malware-via-infected-wordpress-sites-85eqcwd21) · The Hacker News · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#javascript](https://daily.dev/tags/javascript) [View this post on daily.dev](https://daily.dev/posts/online-ad-firm-adform-s-script-compromised-to-steal-cryptocurrency-xskl8wnse) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Online ad firm Adform’s script compromised to steal cryptocurrency","url":"https://daily.dev/posts/online-ad-firm-adform-s-script-compromised-to-steal-cryptocurrency-xskl8wnse","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/online-ad-firm-adform-s-script-compromised-to-steal-cryptocurrency-xskl8wnse"},"datePublished":"2026-07-31T21:14:27.326Z","dateModified":"2026-08-04T17:22:53.035Z","description":"Online adtech firm Adform suffered a supply-chain attack on July 27, 2026, when its JavaScript tracking script 'trackpoint-async.js' was trojanized to steal...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ed7e1b25912fda6d13efb9329d8aa5ea?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ed7e1b25912fda6d13efb9329d8aa5ea?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/online-ad-firm-adform-s-script-compromised-to-steal-cryptocurrency-xskl8wnse","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,javascript","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Online ad firm Adform’s script compromised to steal cryptocurrency"}]} ```