Critical Flaw in Google Ad Manager Exploited to Deliver Crypto-Stealing Malware

Key Takeaways

• Adform, a major advertising technology firm, suffered a supply chain compromise where its ad-serving infrastructure was used to distribute crypto-stealing malware.
• Attackers injected malicious code into a widely used JavaScript tracking script, silently infecting visitors to thousands of websites leveraging Adform’s services.
• The malware functions as a clipboard hijacker, replacing cryptocurrency wallet addresses with attacker-controlled ones, and also collects victim IP addresses and visited URLs.
• The attack was highly stealthy, with all associated malicious indicators initially appearing clean on major security platforms due to the compromise of a trusted source.
• Website operators using Adform’s services are urged to audit third-party scripts and monitor outbound traffic for suspicious activity.

Adform Supply Chain Compromise Delivers Crypto-Stealing Malware

Adform, a prominent advertising technology provider with an estimated 30% share of the demand-side platform market and serving approximately 14,000 businesses, has experienced a significant supply chain breach. This compromise transformed its trusted ad-serving network into a conduit for distributing malware designed to steal cryptocurrency.

The incident was brought to light by security researcher Kevin Beaumont, who discovered that threat actors had hijacked a commonly deployed JavaScript file. This enabled them to covertly infect users browsing thousands of websites that integrate Adform’s advertising solutions.

The compromised element was a tracking script, hosted on Adform’s own domain, which is routinely embedded across numerous client websites to monitor advertising campaign performance.

Stealthy Distribution via Trusted Script

The widespread reliance on this single script meant that by compromising just one file, attackers gained potential access to millions of end-users. Any individual visiting a website that incorporated Adform’s tracking pixel could have unwittingly downloaded malicious code, making this a classic example of a supply chain attack.

Upon execution, the malicious script operates as a clipboard hijacker, a type of malware specifically engineered for cryptocurrency theft. It continuously monitors the victim’s clipboard, scanning every few seconds for copied Bitcoin, Ethereum, or Tron wallet addresses. When a legitimate wallet address is detected, the script surreptitiously replaces it with an address controlled by the attackers.

Given the complexity and length of cryptocurrency addresses, most users paste them without meticulous verification. This vulnerability allows funds intended for legitimate recipients to be diverted directly into a hacker’s wallet. The malware’s persistence is particularly concerning; even if a victim notices the discrepancy and re-copies the correct address, the malicious script overwrites it again during its subsequent polling cycle.

Beyond its financial theft capabilities, the script also functions as a surveillance tool. It silently logs the victim’s IP address, the referring website, and the specific URL path visited. This collected data is then transmitted back to an attacker-controlled server, providing insights into the spread of the supply chain compromise and helping the attackers map their reach across affected sites.

Evasion of Detection Mechanisms

A particularly alarming aspect of this incident is its ability to circumvent conventional security defenses. Initial checks against leading antivirus and threat intelligence platforms showed that every file, URL, domain, and IP address associated with the attack returned clean results. The malicious code was expertly concealed within a script originating from a legitimate and trusted advertiser, allowing it to bypass standard security filters designed to flag suspicious third-party content.

As of this reporting, Adform has not publicly confirmed whether it has notified affected customers or issued a formal disclosure. However, Kevin Beaumont has observed indicators suggesting the active removal of the malicious code, implying that either Adform or the attackers are aware that the operation has been exposed.

The indicators of compromise (IoCs) related to this attack include:

• IP Address: 84.32.102[.]230 (Attacker-controlled beacon/C2 server on port 7744)
• Domain: s2.adform[.]net (Compromised Adform subdomain serving malicious script)
• URL: hxxps://s2[.]adform.net/banners/scripts/st/trackpoint-async.js (Malicious tracking script delivering clipboard hijacker)
• File Hash (SHA-256): 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55 (Malicious payload file, flags clean on VirusTotal)
• Beacon URL Pattern: hxxp://84.32.102[.]230:7744/p?h=<domain>&u=<path> (Data exfiltration request pattern, including victim domain and URL path)

What You Should Do

For website operators utilizing Adform’s services, immediate action is crucial:

• Audit Third-Party Scripts: Conduct a thorough review of all third-party JavaScript files, especially those sourced from advertising platforms like Adform, to identify any unauthorized modifications or suspicious inclusions.
• Monitor Outbound Traffic: Implement robust network monitoring to detect and alert on outbound connections to the identified attacker infrastructure (e.g., IP address 84.32.102[.]230 on port 7744), as well as any unusual data exfiltration patterns.
• Rotate Credentials: If the compromise of Adform’s platform suggests broader access, consider rotating any API keys, tokens, or credentials that may have been exposed or used to integrate with Adform’s services.
• Educate Users: Advise internal users and customers to exercise extreme caution when pasting cryptocurrency wallet addresses and to always double-check the address before finalizing transactions.
• Review Security Logs: Analyze web server and client-side security logs for any indicators of compromise related to the malicious script or its beaconing activity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.