Online advertising firm Adform disclosed that attackers compromised one of its JavaScript delivery pipelines and used it to serve a clipboard-hijacking payload to visitors of every site embedding the affected script. Researchers are tracking the operation as CaptiveCrunch and assess it as an operational sub-cluster of Midnight Blizzard — the Russian state-linked actor also known as APT29 or Cozy Bear.

What happened

The compromised resource is trackpoint-async.js, served from s2.adform.net and embedded by ad campaigns across a large number of unrelated customer websites. Because the script is shared infrastructure, compromising it once gave the attackers a foothold on every downstream site that loads it — a textbook supply-chain multiplier, no individual site breach required.

Adform says it detected the tampering on July 27, 2026, removed the malicious code, notified affected customers, and reported the incident to authorities. Independent researcher Kevin Beaumont has said he observed malicious activity tied to Adform-served scripts for roughly a week before the public disclosure, meaning the exposure window is likely longer than Adform’s own timeline suggests.

Technical details

The attackers appended an obfuscated function to the end of the legitimate trackpoint-async.js library. The injected code runs a clipboard-clipper: it polls the browser clipboard every few seconds, pattern-matches the contents against Bitcoin, Ethereum, and Tron address formats, and — on a match — silently overwrites the clipboard with an attacker-controlled address in the same format. Anyone who copied a wallet address on an affected page and pasted it into a wallet or exchange without visually re-checking every character risked sending funds directly to the attacker.

Separately, researchers observed other Adform-hosted scripts beaconing to an attacker-controlled server at 84.32.102.230:7744, exfiltrating the visiting user’s IP address, referring site, and URL path — likely for target profiling or campaign telemetry rather than the theft itself. At time of writing, the malicious script variant was not flagged by any engine on VirusTotal, underscoring how effectively a small, targeted clipboard hook can evade signature-based detection when appended to an otherwise-trusted, widely-cached library.

Because the malicious code lived inside a cached JavaScript file rather than a server-side component, removing it from Adform’s origin does not immediately clear it from browsers that already cached the poisoned version — Adform is explicitly telling visitors to clear their browser cache in addition to patching origin delivery.

Impact

This is not a targeted breach of any single company; it’s a watering-hole-style compromise of shared ad-tech infrastructure that silently touched every visitor of every site running the affected tag, regardless of what that site does or who its audience is. Anyone who copy-pasted a Bitcoin, Ethereum, or Tron address on an affected page between the injection point and the July 27 cleanup should treat any transfer sent during that window as potentially compromised. Attribution to a Midnight Blizzard sub-cluster is also notable on its own: APT29 is best known for espionage against governments and cloud/identity providers (SolarWinds, Microsoft, HPE), so a financially-motivated clipper campaign — if the attribution holds — would mark a departure from, or a parallel financing operation alongside, its usual tradecraft.

Mitigation

  • Site operators embedding Adform tags should confirm they are serving the patched trackpoint-async.js, purge CDN and browser caches for the affected resource, and review outbound network logs for connections to 84.32.102.230:7744.
  • End users who copied a cryptocurrency address on any site during the affected window should manually re-verify the last transaction’s destination address against a trusted source and treat any mismatch as a compromise requiring immediate contact with their exchange or wallet provider.
  • Security teams should not treat third-party ad, analytics, and tag-manager scripts as inherently trustworthy just because they’re widely used — apply Subresource Integrity (SRI) hashing or self-hosting for high-traffic third-party JS where feasible, and monitor for clipboard-API usage in scripts that have no legitimate reason to touch it.
  • Treat this as a live IOC hunt, not a closed incident: Adform’s own detection lagged independent researcher observation by up to a week, so downstream sites should assume additional undisclosed tampering is possible and monitor accordingly.

Sources: The Hacker News, BleepingComputer, Kevin Beaumont / DoublePulsar.