{"id":36467,"date":"2026-08-11T10:18:13","date_gmt":"2026-08-11T14:18:13","guid":{"rendered":"https:\/\/www.kaspersky.com.au\/blog\/?p=36467"},"modified":"2026-08-12T01:29:37","modified_gmt":"2026-08-11T14:29:37","slug":"adform-compromise-malicious-ads-cryptocurrency-theft","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/adform-compromise-malicious-ads-cryptocurrency-theft\/36467\/","title":{"rendered":"A billion risky impressions: lessons from the Adform hack"},"content":{"rendered":"

Adform, a major advertising platform, remained compromised for roughly 24 hours from late on July 26 through the evening of July 27 after being breached by unknown attackers. Few people outside the industry recognize the name, but Adform serves around 1.5 billion ad impressions every day<\/a> across tens of thousands of websites. That means anyone visiting any site that runs Adform ads could have been targeted.<\/p>\n

The attackers weren\u2019t trying to install malware. Instead, they ran a script in the victim\u2019s browser that checked the clipboard every three seconds, and if it found a cryptocurrency wallet address had been copied, swapped it for the attackers\u2019 own wallet address. So if someone had a site with the malicious ad open in one browser tab, and was making a crypto transaction in another tab or in a dedicated app, the funds could have ended up in the attackers\u2019 pockets instead. Adform\u2019s owners caught the attack and fixed the problem, but there\u2019s no guarantee a similar incident won\u2019t happen again \u2014 which is why every user should defend themselves against malvertising<\/a>. Check out our tips at the end of this post.<\/p>\n

What we know about the attack on Adform<\/h2>\n

There isn\u2019t a lot of information out there, since the company\u2019s official statement<\/a> covers only what happened and when, without getting into the root cause of the incident. Independent research<\/a> has dug up technical details about how ordinary users were targeted, but none of that explains how Adform itself was breached in the first place.<\/p>\n

What\u2019s clear is that the attackers slipped their own code into the JavaScript that loaded on every site running Adform ads. Whenever an ad was about to display, the script would load from Adform\u2019s server, pick the right ad, and show it\u00a0\u2014 but the attackers had tacked on a set of malicious functions: monitoring the clipboard, sending data about the site where the encounter happened, and the victim\u2019s IP address back to their own server, and swapping out Bitcoin, Ethereum, and Tron wallet addresses.<\/p>\n

All it took to make it work was having any site with Adform-served ads open in one browser tab. It didn\u2019t matter what kind of site it was, what the ad looked like, or which advertiser it belonged to. The one thing that mattered was whether the site ran over HTTP or HTTPS. According to Adform, the attack couldn\u2019t succeed on a site loaded over HTTPS since the connection to the attackers\u2019 server was blocked in this case.<\/p>\n

The company hasn\u2019t shared any information on how many users were affected, or how many sites still serve their content and ads over HTTP.<\/p>\n

Malicious ads are an everyday occurrence<\/h2>\n

Unfortunately, dangerous online ads have become a systemic problem. And we\u2019re not just talking about sketchy supplement ads or gambling promos\u00a0\u2014 we mean ads that spread malware or lead to sites designed to steal payment details and other valuable data. Attackers have built out industrial-scale infrastructure to pull this off, and they use several different approaches.<\/p>\n