Adform Supply Chain Attack: JavaScript Poisoning and Crypto Wallet Swapping - Detection and Defense Guide

---
title: Adform Supply Chain Compromise - Malicious JavaScript Access
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects access to Adform JavaScript domains during the known supply chain compromise window (July 27, 2026) when attackers modified scripts to swap cryptocurrency wallet addresses
references:
  - https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html
author: Security Arsenal
date: 2026/07/28
tags:
  - attack.initial_access
  - attack.supply_chain
  - attack.t1195.002
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains:
      - 's1.adform.net'
      - 's2.adform.net'
      - 'track.adform.net'
    cs-method: 'GET'
    c-uri|contains: '.js'
  timeframe: 2026/07/27-2026/07/28
  condition: selection
falsepositives:
  - Legitimate advertising traffic from unaffected organizations
level: high
---
title: Suspicious Clipboard Access via Third-Party JavaScript
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects web traffic patterns consistent with JavaScript clipboard manipulation, a technique used in the Adform supply chain attack to swap cryptocurrency wallet addresses
references:
  - https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html
author: Security Arsenal
date: 2026/07/28
tags:
  - attack.collection
  - attack.t1056.002
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: 
      - 'execCommand('
      - 'clipboard.writeText'
      - 'navigator.clipboard'
    c-uri|endswith: '.js'
  filter:
    cs-host|endswith:
      - 'coinbase.com'
      - 'metamask.io'
      - 'trustwallet.com'
  condition: selection and not filter
falsepositives:
  - Legitimate cryptocurrency wallet applications
  - Copy-to-clipboard functionality in web applications
level: medium

// Hunt for Adform JavaScript access during the compromise window
// Uses CommonSecurityLog (CEF/Syslog from firewalls, proxies)
let compromise_start = datetime(2026-07-27T00:00:00Z);
let compromise_end = datetime(2026-07-28T00:00:00Z);
let adform_domains = dynamic(['s1.adform.net', 's2.adform.net', 'track.adform.net']);
CommonSecurityLog
| where TimeGenerated between(compromise_start .. compromise_end)
| where RequestURL has_any(adform_domains)
| where RequestURL has ".js" and RequestMethod == "GET"
| summarize count() by SourceIP, DestinationIP, RequestURL, DeviceAction, _ResourceId
| where count_ > 0
| extend RiskScore = iff(count_ > 50, "High", "Medium")
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RiskScore, count_, DeviceAction
| order by count_ desc

-- Hunt for cached Adform-related files during compromise window
-- Targeting browser cache locations

LET start_time = timestamp("2026-07-27")
LET end_time = timestamp("2026-07-28")
LET adform_pattern = "adform"

-- Scan for recently modified files in browser cache directories
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
    "C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Cache/*",
    "C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Cache/*"
])
WHERE FullPath =~ adform_pattern
   AND Mtime > start_time 
   AND Mtime < end_time

# Adform Supply Chain Incident - Verification and Hardening Script
# Version: 1.0
# Date: 2026-07-28

param(
    [string]$WebRoot = "C:\inetpub\wwwroot",
    [switch]$Verbose
)

function Write-ColorOutput {
    param([string]$Message, [string]$Color = "White")
    Write-Host $Message -ForegroundColor $Color
}

Write-ColorOutput "=== Adform Supply Chain Incident Response ===" "Yellow"
Write-ColorOutput "Scanning web root: $WebRoot" "Cyan"
Write-ColorOutput ""

# Step 1: Identify files with Adform script references
Write-ColorOutput "[Step 1] Scanning for Adform script references..." "Yellow"
$adformFiles = @()
$htmlFiles = Get-ChildItem -Path $WebRoot -Include *.html, *.aspx, *.php, *.jsp -Recurse -ErrorAction SilentlyContinue

foreach ($file in $htmlFiles) {
    $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
    if ($content -match 'adform') {
        $adformFiles += $file.FullName
        Write-ColorOutput "  Found: $($file.FullName)" "Cyan"
        
        # Check for SRI implementation
        if ($content -match 'integrity\s*=') {
            Write-ColorOutput "    SRI attribute detected" "Green"
        } else {
            Write-ColorOutput "    NO SRI attribute - VULNERABLE" "Red"
        }
        
        # Check for nonce in CSP
        if ($content -match 'nonce-') {
            Write-ColorOutput "    CSP nonce detected" "Green"
        }
    }
}

if ($adformFiles.Count -eq 0) {
    Write-ColorOutput "  No Adform references found" "Green"
}

Write-ColorOutput ""

# Step 2: Generate hash of current Adform scripts for baseline
Write-ColorOutput "[Step 2] Generating baseline hashes for external scripts..." "Yellow"
$scriptRegex = '(?<=src\s*=\s*["\'])(https?:\/\/[^"\']+\.js[^"\']*)(?=["\'])'
foreach ($file in $adformFiles) {
    $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
    $matches = [regex]::Matches($content, $scriptRegex)
    
    foreach ($match in $matches) {
        $scriptUrl = $match.Value
        if ($scriptUrl -match 'adform') {
            Write-ColorOutput "  Script: $scriptUrl" "Gray"
        }
    }
}

Write-ColorOutput ""

# Step 3: Provide remediation recommendations
Write-ColorOutput "[Step 3] Remediation Recommendations" "Yellow"
Write-ColorOutput "1. IMMEDIATE: Verify Adform script integrity against known-good versions" "White"
Write-ColorOutput "2. Implement Subresource Integrity (SRI) for all external scripts:" "White"
Write-ColorOutput "   <script src='...' integrity='sha384-...' crossorigin='anonymous'></script>" "Gray"
Write-ColorOutput "3. Add Content Security Policy header:" "White"
Write-ColorOutput "   Content-Security-Policy: script-src 'self' 'nonce-RANDOM' https://s1.adform.net;" "Gray"
Write-ColorOutput "4. Consider proxying third-party scripts through your own domain" "White"
Write-ColorOutput "5. Enable browser security headers: X-Content-Type-Options, X-Frame-Options" "White"

Write-ColorOutput ""
Write-ColorOutput "=== Scan Complete ===" "Yellow"
Write-ColorOutput "Affected files found: $($adformFiles.Count)" "Cyan"