Affected Systems

Adform advertising platform customers; specifically the trackpoint-async.js file served from s2.adform[.]net. Sites embedding this tracking script were affected on July 27, 2026 (confirmed date), with reports suggesting possible exposure up to one week prior. Adform serves ~1,800 customers globally; exact number of affected sites and page loads not disclosed.

Exploitation Status

Active exploitation confirmed. Malicious code was live on July 27, 2026, and possibly earlier. The compromised JavaScript file actively replaced Bitcoin, Ethereum, and Tron wallet addresses in real-time on victim browsers. Captured sample publicly available (published by Max Maass). No attribution or details on initial access vector disclosed by Adform.

Business Impact

Any organization embedding Adform's trackpoint-async.js on their website unknowingly served malicious code to visitors. Users who copied or entered cryptocurrency wallet addresses on affected pages between July 27 (or earlier) and remediation had those addresses silently replaced with attacker-controlled wallets. Financial loss scope unknown. The malicious code operated only in-browser with no persistence, but cached copies may remain active until users clear browser cache. Adform has not disclosed how attackers gained write access to their CDN infrastructure, raising questions about platform security posture. No CVE assigned. Timeline discrepancy (July 27 vs. week-long observation) complicates exposure assessment.

Urgency

🔴 Immediate

Recommended Actions

  • Identify all web properties embedding Adform trackpoint-async.js from s2.adform[.]net and verify the malicious version is no longer served; check CDN logs for July 20–27, 2026 timeframe.
  • Instruct all users who visited your sites between July 20–27, 2026 to clear browser cache immediately and verify any cryptocurrency wallet addresses used during that period before sending funds.
  • Block outbound connections to 84.32.102[.]230:7744 at perimeter firewalls and review proxy/firewall logs for any connections to this IP from internal networks during the exposure window.
  • Review and harden third-party JavaScript inclusion policies: implement Subresource Integrity (SRI) hashes for all external scripts and deploy Content Security Policy (CSP) headers to limit script execution domains.
  • Contact Adform directly for incident-specific IOCs, confirmed exposure timeline, and details on their remediation and security improvements to prevent recurrence.