An attack on advertising technology company Adform temporarily turned code running on customer websites into a crypto wallet-address hijacker, with a subsequent investigation finding that some visitors to HTTP webpages may also have had their public IP addresses and browsing details exposed.
Adform detected suspicious activity on July 27, 2026. Retrospective analysis later found the first malicious activity occurred at 11:49 p.m. CEST on July 26, according to an updated company disclosure. Adform said it had seen no further distribution of the malicious code after 7:16 p.m. CEST on July 27.
The malicious code targeted Bitcoin, Ethereum and Tron transactions by attempting to replace cryptocurrency wallet addresses displayed, entered, copied or pasted while an affected webpage was open.
Adform said the code was not designed to install software on a visitor’s device or establish persistence. Instead, it operated while an affected webpage remained open.
The incident demonstrates the reach of a web supply-chain compromise: attackers can abuse code distributed by a trusted third-party service to reach visitors on websites that were not themselves directly breached.
Adform Finds Possible IP Address Exposure on HTTP Pages
Adform’s investigation produced an important update after its initial July 31 disclosure.
The company said an affected Adform script running on certain webpages served over HTTP attempted to contact infrastructure believed to have been operated by or accessible to the attacker.
If the connection succeeded, the receiving infrastructure could have obtained the website hostname, webpage path and source or public IP address associated with the request, according to Adform.
The company therefore said it could not rule out exposure of IP addresses belonging to some visitors of affected HTTP webpages.
HTTPS made an important difference.
According to Adform’s technical assessment, browsers prevented the relevant outbound request from completing when affected webpages were served over HTTPS. That protection would not have applied to HTTP pages.
Adform said it had found no evidence that the malicious script transmitted webpage contents, account credentials, information entered by users or other data fields beyond the hostname, page path and potentially public IP address.
The company notified Denmark’s Data Protection Authority on Aug. 5 about the potential personal-data impact associated with the HTTP-related incident and said it had also reported the broader security incident to other relevant authorities.
Malicious Code Targeted Crypto wallet Transactions in the Browser
The attack was designed to interfere with cryptocurrency transfers rather than compromise cryptocurrency blockchains themselves.
Adform said the malicious code could replace Bitcoin, Ethereum or Tron wallet addresses while an affected webpage was open.
Independent reporting and technical analysis found that the attack went beyond simply changing a wallet address stored in the clipboard. The injected JavaScript could monitor browser interactions and manipulate cryptocurrency addresses displayed or entered on affected pages.
That distinction matters because cryptocurrency transactions generally cannot be reversed after confirmation. A user who failed to notice that a destination address had changed could potentially authorize a legitimate transaction to an attacker-controlled wallet.
Adform has not publicly established how many visitors encountered the malicious code or whether the attack successfully redirected cryptocurrency transfers.
Why a Third-Party Script Can Affect Unrelated Websites
The incident illustrates a fundamental security problem with third-party JavaScript.
Websites routinely load scripts from outside providers for advertising, analytics, customer support, payments and other services. Those scripts can execute inside a visitor’s browser with significant access to the webpage.
If centrally hosted code is compromised, malicious changes can consequently reach multiple downstream websites without attackers having to breach every publisher individually.
In Adform’s case, the affected technology was part of an advertising platform with substantial reach. The company’s previously reported business figures indicated that its broader platform handled about 1.5 billion advertising impressions per day and served roughly 1,800 customers in more than 180 countries.
Those numbers do not show how many websites or visitors were affected by this particular incident. Adform has not disclosed a confirmed total for either.
That distinction is important: the potential reach of a compromised advertising platform should not be treated as the confirmed victim count.
Questions About the Initial Compromise Remain
One of the biggest unanswered questions is how the attackers gained the ability to modify code distributed through Adform’s infrastructure.
Adform’s public updates describe the malicious activity, its response and findings from the subsequent investigation, but have not identified a threat actor or publicly detailed the initial intrusion method.
The company said it contained the incident, removed the malicious code and took additional measures to protect visitors, customers and its platform.
Adform also sought to notify relevant affected parties, including advertisers using affected Site Tracking technology on HTTP webpages and publishers operating HTTP properties where affected advertising technology ran.
What Website Visitors and Publishers Should Do
Adform recommends that people who visited a website using affected technology on July 27 clear their browser cache as a precaution because browsers can temporarily store website code.
Anyone who displayed, entered, copied or pasted a Bitcoin, Ethereum or Tron address while an affected page was open should also review the destination wallet address and relevant transaction records for discrepancies.
For website operators, the incident highlights a broader issue: externally hosted scripts should be treated as part of a site’s security exposure rather than harmless add-ons. generative AI security risks
Reducing unnecessary third-party JavaScript, maintaining an inventory of external dependencies, enforcing HTTPS and monitoring changes in externally supplied code can reduce the attack surface.
Controls such as Content Security Policy can also restrict which resources a webpage is permitted to load or communicate with, although no single browser security control eliminates supply-chain risk. AI cybersecurity testing
The Adform incident has been contained, according to the company, but its wider lesson remains relevant. When websites allow third-party code to execute in visitors’ browsers, the security of those external providers becomes part of the security of the websites themselves.
