What Happened
On July 27, security researcher Kevin Beaumont discovered that Adform's JavaScript tracking script had been compromised to steal cryptocurrency. The malicious code monitored users' clipboards for Bitcoin, Ethereum, and TRON wallet addresses, replacing them with attacker-controlled addresses. Adform serves tracking scripts to thousands of sites across Europe, turning a single compromise into a supply-chain attack affecting countless users.
Adform removed the malicious code shortly after discovery and launched an investigation. The attack window remains unclear from public reporting.
Timeline
July 27: Kevin Beaumont identifies the compromised script during security research.
July 27 (hours later): Adform removes the malicious code from their tracking script.
Post-discovery: Adform begins an internal investigation. VirusTotal analysis shows zero detection by antivirus engines at the time of discovery.
The quick response suggests either limited attacker dwell time or rapid detection by Adform's team once alerted. We don't have data on when the compromise actually occurred.
Which Controls Failed or Were Missing
Script Integrity Monitoring: Adform's production JavaScript was modified without triggering alerts. Your team should implement integrity checks that flag unauthorized changes before they reach production.
Code Review for Third-Party Dependencies: If the compromise came through a dependency or build pipeline, it bypassed code review. Even automated tracking scripts need review gates.
Runtime Behavior Monitoring: The script actively monitored clipboard events, a behavior that should trigger anomaly detection. Clipboard access isn't typical for ad tracking.
Subresource Integrity (SRI): Websites embedding Adform's script likely weren't using SRI hashes, which would have prevented browsers from executing the modified version.
Detection Tooling Gaps: VirusTotal showed zero detections across all engines. Traditional signature-based antivirus doesn't catch obfuscated JavaScript modifications in legitimate scripts.
What the Standards Require
PCI DSS v4.0.1 Requirement 6.4.3 mandates that all scripts loaded on payment pages be authorized and their integrity verified. If you're processing payments and loading third-party ad scripts, you need documented authorization and integrity controls. This requirement specifically calls out preventing unauthorized scripts from executing.
PCI DSS v4.0.1 Requirement 11.6.1 requires detecting changes to HTTP headers and script contents on payment pages. You need automated mechanisms that alert on modifications to any script your pages load, including third-party tracking.
OWASP ASVS v4.0.3 Section 14.2 covers content security policy requirements. V14.2.1 requires CSP headers that prevent inline script execution. V14.2.3 requires SRI for all external scripts. Both would have limited this attack's impact.
NIST CSF v2.0 PR.DS-6 addresses integrity checking mechanisms. You need technical controls that verify the integrity of software and information. For third-party scripts, this means SRI hashes, CSP directives, and monitoring for unexpected changes.
ISO/IEC 27001:2022 Control 8.24 requires the use of cryptography to protect information. SRI uses cryptographic hashes to verify script integrity. If you're loading external scripts, implementing SRI isn't optional under this control.
Lessons and Action Items for Your Team
Implement Subresource Integrity immediately. For every third-party script your site loads, generate an SRI hash and include it in your script tag. When Adform's script changed, browsers would have refused to execute it. This is a one-afternoon project with immediate protection.
<script src="https://track.adform.net/script.js"
integrity="sha384-hash-here"
crossorigin="anonymous"></script>
Deploy Content Security Policy headers. Start with report-only mode if you're worried about breaking things. Your CSP should whitelist specific script sources and block inline scripts. The clipboard-monitoring code would have violated a properly configured CSP.
Monitor for clipboard API usage. If you're running any JavaScript that touches the clipboard API, you should know about it. Set up monitoring that alerts when clipboard events fire on pages where you don't expect them. This catches both compromised third-party scripts and malicious browser extensions.
Audit your third-party script dependencies. List every external script your site loads. For each one, document: why you need it, what data it accesses, whether you can self-host it, and when you last reviewed it. You can't protect what you don't inventory.
Build a script allowlist with your security team. Marketing shouldn't add tracking scripts without security review. Create a process where new third-party scripts go through threat modeling before they touch production. Ask: What data does this access? What happens if it's compromised? Can we limit its scope with CSP?
Test your detection capabilities against obfuscated JavaScript. The VirusTotal results show that traditional AV doesn't catch this. Can your SIEM detect unusual clipboard access patterns? Can your web application firewall spot suspicious script modifications? Run tabletop exercises where you simulate a compromised third-party script.
Separate tracking from critical flows. If you're loading ad-tech scripts on payment pages, stop. Put tracking on marketing pages, not checkout flows. The PCI DSS requirements for payment pages are stricter for exactly this reason.
Set up alerts for script hash mismatches. When browsers encounter an SRI hash that doesn't match, they log a console error. Collect these errors. A spike in SRI failures means either your CDN is serving stale content or something changed that shouldn't have.
The Adform incident shows that supply-chain attacks don't require sophisticated zero-days. Compromise one widely used script, wait for users to copy wallet addresses, and replace them in transit. The technical bar is low. Your defense needs to be robust: integrity checks, behavior monitoring, and defense-in-depth through CSP and SRI. Start with the SRI implementation this week.
