Adform Supply-Chain Compromise: Crypto-Clipboard Hijacking Defense

A critical supply-chain attack has impacted Adform, a prominent online advertising platform. Attackers successfully compromised Adform's ad scripts, injecting malicious JavaScript into the trusted codebase served to partner websites. This payload functions as a clipboard hijacker, actively monitoring user activity to replace cryptocurrency wallet addresses copied to the clipboard with addresses controlled by the attacker.

For defenders, this represents a sophisticated Magecart-style evolution. Unlike traditional data skimmers targeting credit cards, this silent modification targets financial transactions directly, often bypassing standard user verification checks. Organizations hosting Adform scripts are currently acting as unwilling intermediaries in financial theft, requiring immediate forensic validation of web assets.

Technical Analysis

Affected Products: Adform advertising platform integration scripts (JavaScript).
Attack Vector: Supply-chain compromise. The trusted JavaScript file hosted by Adform or served via their ad delivery network was modified to include malicious payload logic.
Mechanism:
- Injection: The malicious script loads on the client-side when a visitor accesses a webpage running Adform ads.
- Behavior: The script utilizes browser APIs (such as navigator.clipboard or older execCommand methods) to monitor copy events or poll the clipboard content.
- Payload Logic: It uses Regular Expressions (Regex) to identify strings matching the format of popular cryptocurrency wallet addresses (e.g., BTC, ETH). Upon detection, it silently overwrites the clipboard content with the attacker's wallet address.
Exploitation Status: Confirmed active exploitation. The attack is currently in-the-wild, affecting visitors to websites utilizing the compromised Adform script.

Detection & Response

SIGMA Rules

YAML

---
title: Adform Compromised Script Access via Proxy
id: 8a4b2c1d-6e9f-4a3b-8c5d-1e2f3a4b5c6d
status: experimental
description: Detects outbound connections to Adform ad scripts. During this incident, valid domains may serve malicious payloads. Correlate with content-hash changes if possible.
references:
  - https://www.bleepingcomputer.com/news/security/online-ad-firm-adforms-script-compromised-to-steal-cryptocurrency/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.supply_chain
logsource:
  category: proxy
  product: websense
  # Can be adapted for squid, bluecoat, etc.
detection:
  selection:
    cs-uri|contains|all:
      - 'adform'
      - '.js'
  condition: selection
falsepositives:
  - Legitimate advertising traffic
level: low
---
title: Web Server Detection of Clipboard Hijacking Keywords
id: 9c5d3e2a-7f0a-5b4c-9d6e-2f3a4b5c6d7e
status: experimental
description: Detects potential clipboard hijacking behavior in web server logs by identifying suspicious API calls or keywords often used in crypto-stealing scripts.
references:
  - https://www.bleepingcomputer.com/news/security/online-ad-firm-adforms-script-compromised-to-steal-cryptocurrency/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1056
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-uri-query|contains:
      - 'clipboard'
      - 'writeText'
      - 'execCommand'
      - 'walletaddress'
  condition: selection
falsepositives:
  - Legitimate web application clipboard functionality
level: medium

KQL (Microsoft Sentinel)

Use this query to hunt for spikes in traffic to Adform endpoints or look for suspicious script access patterns in your proxy logs.

KQL — Microsoft Sentinel / Defender

// Hunt for connections to Adform ad serving infrastructure
let AdformDomains = dynamic(["adform.net", "adform.com", "adform.dk"]);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (AdformDomains)
| where RemoteUrl contains ".js"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| summarize count() by RemoteUrl, bin(Timestamp, 1h)
| sort by count_ desc

Velociraptor VQL

Hunt web server caches or directories for Adform script tags to identify which internal assets are currently loading the compromised resource.

VQL — Velociraptor

-- Hunt for HTML files containing references to Adform scripts
SELECT FullPath, Mtime, Size
FROM glob(globs="/*/*.html")
WHERE read_file(filename=FullPath)
   =~ '(?i)<script[^>]+src[^>]*adform'

Remediation Script (PowerShell)

This script scans a specified web root directory for HTML files referencing Adform scripts and checks if Subresource Integrity (SRI) attributes are missing—a critical defense against supply-chain tampering.

PowerShell

<#
.SYNOPSIS
    Audit Web Content for Adform Scripts and SRI Implementation.
.DESCRIPTION
    Scans a directory for HTML files referencing 'adform' scripts.
    Checks if the script tag includes an 'integrity' attribute (SRI).
#>

param(
    [Parameter(Mandatory=$true)]
    [string]$WebRootPath
)

Write-Host "[+] Scanning $WebRootPath for Adform script references..."

$files = Get-ChildItem -Path $WebRootPath -Recurse -Include *.html, *.htm, *.aspx, *.php

foreach ($file in $files) {
    $content = Get-Content -Path $file.FullName -Raw
    if ($content -match '(?i)<script[^>]+src[^>]*adform[^>]*>') {
        $match = $Matches[0]
        
        if ($match -notmatch 'integrity=') {
            Write-Host "[!] ALERT: Adform script found WITHOUT SRI in $($file.FullName)" -ForegroundColor Red
            Write-Host "    Tag: $match"
        } else {
            Write-Host "[+] OK: Adform script found with SRI in $($file.FullName)" -ForegroundColor Green
        }
    }
}

Write-Host "[+] Scan complete."

Remediation

Immediate Removal: If your organization utilizes Adform for advertising, immediately remove the ad script tags from your web properties until Adform confirms the integrity of their delivery network.
Verify Integrity: Contact Adform support to obtain the correct file hashes (SHA-256) for their current script versions. Compare these against the files currently served to your environment.
Implement Subresource Integrity (SRI):
- For any third-party script re-inclusion, you must use SRI. This involves adding a cryptographic hash to the <script> tag (e.g., <script src="https://..." integrity="sha384-..." crossorigin="anonymous"></script>).
- If the file is tampered with, the browser will refuse to load it, neutralizing the supply-chain attack.
Content Security Policy (CSP):
- Review your CSP headers. Strictly limit which domains can load scripts. Consider using script-src directives with hashes or nonces for internal scripts.
User Communication: If your site was serving the malicious script, notify your users immediately, advising them to verify cryptocurrency wallet addresses before pasting/confirming transactions during the compromise window.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub