On 27 July 2026, attackers modified a JavaScript file served by advertising technology firm Adform, converting it into a tool that intercepted and rewrite cryptocurrency wallet addresses in real time. Anyone visiting an affected site and copying a wallet address would unknowingly paste the attacker's address instead. The incident underscores a persistent vulnerability in modern web infrastructure: the assumption that third-party scripts are trustworthy.
How the Attack Worked
The compromise was straightforward in execution but difficult to detect. Adform's JavaScript runs on thousands of customer websites to manage advertisements and tracking. An attacker gained write access to one of these scripts—likely through compromised credentials or an unpatched service vulnerability—and injected code that performed real-time text substitution in the browser's DOM.
When a user copied a cryptocurrency wallet address from a website, the injected script intercepted the clipboard operation and replaced it with an attacker-controlled address. The user would then paste the wrong address when sending funds, routing cryptocurrency to the attacker instead of the intended recipient. Unlike malware that steals existing credentials, this attack required no installation or persistence; it worked passively against any visitor.
Adform detected the modification on the same day and removed the malicious code, but the attack window—even if brief—exposed thousands of sites simultaneously. The scale of the incident illustrates why third-party script injection remains attractive to attackers: a single compromise can affect an entire supply chain.
Supply Chain Risk and Hosting Context
Site operators typically load external JavaScript for analytics, advertisements, payment processing, and other services. Each external dependency becomes a potential attack surface. A compromised CDN, advertising network, or tracking service can inject malware into all customer sites at once.
From a hosting and infrastructure perspective, this highlights the difference between managed risk and delegated risk. When a website runs its own authentication or payment processing on its own infrastructure, the operator controls the threat model. When those functions depend on a third party's infrastructure and security posture, control is transferred to that vendor. Adform's breach wasn't the customer sites' fault, but it affected them anyway.
Infrastructure teams often have limited visibility into third-party scripts. Many organisations implement Content Security Policy (CSP) headers to restrict script sources, but doing so requires knowing which scripts are actually necessary and maintaining that list as vendors change. A stolen API key or database backup can go unnoticed for weeks if the attacker is careful.
Detection and Mitigation Strategies
Operators cannot assume third parties are secure, even large, established ones. Several practices reduce exposure:
- Subresource Integrity (SRI): Include a cryptographic hash in the script tag so browsers reject any version that doesn't match. This prevents tampered scripts from executing, though it requires pinning hashes and updating them when vendors push legitimate updates.
- Content Security Policy: Restrict script sources to specific domains and disable inline script execution. Tighter policies reduce attack surface, but must be carefully tuned to avoid breaking functionality.
- Regular audits of third-party dependencies: Maintain an inventory of all external scripts and periodically review whether each is still necessary. Remove unused vendors to shrink the attack surface.
- Monitoring and alerting: Watch for unexpected changes to third-party scripts or unusual network activity from injected code. Some services offer third-party script monitoring.
- Isolating sensitive operations: Where possible, handle cryptocurrency transactions, payments, or other sensitive functions on first-party infrastructure rather than relying on third-party providers for core logic.
The Adform incident also emphasises why credential hygiene matters. Attackers likely gained access through phishing, credential reuse, or an unpatched vulnerability. Infrastructure teams should assume attackers will eventually obtain some credentials; the goal is to minimise what those credentials can access and to detect abuse quickly.
The Broader Pattern
Third-party script injection is not new, but it remains effective because the web's architecture trusts scripts implicitly. Once a script executes in the browser, it has full access to the DOM, cookies, local storage, and any clipboard operations. There is no built-in sandboxing or privilege model for scripts based on their source or intent.
This Adform case involved cryptocurrency, which makes it newsworthy, but the same technique works for stealing form data, session tokens, API keys, or redirecting users to phishing pages. The attack surface is only growing as more sites embed more external services.
Site operators and infrastructure teams should treat third-party scripts as controlled dependencies, not trusted components. Verify integrity, limit privileges, monitor for anomalies, and have a plan to respond quickly if a vendor is compromised. The cost of third-party convenience is eternal vigilance.
