Adform Ad Script Hijacked to Swap Cryptocurrency Addresses on Customer Websites

A significant supply chain attack has been discovered involving Adform, a widely used digital advertising platform. Hackers managed to compromise an Adform-provided script that many websites integrate to serve ads. Once modified, the script began to surreptitiously scan web pages for cryptocurrency wallet addresses and replace them with addresses controlled by the attackers. This means that visitors to any site loading the poisoned script could be tricked into sending digital currency to the wrong recipient, with little visible sign of foul play.

The attack exploits the trust that website operators place in third‑party services. By targeting a single script hosted by an advertising network, the attackers could potentially affect hundreds or thousands of customer sites simultaneously, without needing to breach each site individually. When a victim views a page containing a legitimate cryptocurrency address—such as a donation address, a payment option, or a published wallet—the malicious script intervenes before the page finishes loading and swaps in the fraudster’s wallet, often in a way that is indistinguishable from the original to the naked eye.

For website owners, this incident underscores the inherent risk of embedding external JavaScript without adequate safeguards. Even trusted ad networks can be compromised, and the consequences can extend well beyond a simple defacement. Financial losses, damaged reputation, and erosion of user trust are real possibilities. The technique is stealthy: a site owner might never know their pages served poisoned content unless a customer reports a misdirected payment or a security scanner flags the discrepancy.

From a technical perspective, such attacks can be mitigated by adopting modern web security practices. Subresource Integrity (SRI) allows site owners to specify a cryptographic hash for each external script; if the script is altered, the browser refuses to execute it. Content Security Policy (CSP) headers can restrict which domains are allowed to run scripts, adding another layer of defense. Regular audits of third‑party integrations, combined with real‑time monitoring, are essential. For businesses that rely on managed hosting, providers like AEU Hosting offer security‑focused environments that can help detect anomalous script behavior, alerting operators to unexpected changes in code served to visitors.

The incident is also a reminder for everyday users to practice caution. Double‑checking wallet addresses before confirming a transaction—perhaps by using a hardware wallet display or a secondary trusted device—remains one of the most effective countermeasures against address‑swapping malware. As advertising networks investigate and patch the compromise, website operators should review their script dependencies and consider locking down their supply chains to prevent a repeat of this widespread hazard.