Adform Script Compromise Enables Real-Time Crypto Wallet Address Swapping Across Customer Sites

Attackers compromised Adform's JavaScript script to dynamically replace cryptocurrency wallet addresses on customer websites, enabling fund redirection without direct site breaches. The supply-chain attack exploited a shared resource to alter addresses in real-time across multiple domains.

Attackers modified a JavaScript file served by advertising technology company Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses.

Adform detected the incident on July 27, 2026, removed the malicious code, notified affected clients, and reported it to authorities.

Anyone who visited a site carrying the affected script on July 27 and copied a Bitcoin,

Read original article