www.it-connect.fr
Adform Breach: Ad Script Steals Cryptocurrency for at Least a Week
An ad script loaded by thousands of websites was used for at least a week to hijack cryptocurrency transactions. Researcher Kevin Beaumont spotted the compromise of Adform, a European advertising platform that claims around 14,000 customer companies. Here’s what we know.
An ad script turned into a cryptocurrency thief
I came across a very interesting article published by Kevin Beaumont about the compromise of Adform, a Danish company specializing in programmatic advertising. And since he always publishes relevant information, I figured it was worth covering.
Adform is a European DSP (demand-side platform): partner websites embed a piece of JavaScript hosted by the company, which then makes it possible to load ads. In this case, the file named trackpoint-async.js is distributed from the s2.adform.net domain. This file, which is at the heart of the security incident, is clearly mentioned in Adform’s official documentation. It is described as a Tracking Code script, dynamically loaded on customer pages and served identically for all customers.
This is exactly the file that was tampered with. In his report, Kevin Beaumont states: "Adform has been hacked. As far as I can tell, Adform did not warn anyone." The researcher adds that if you visit a site that uses Adform, that site is what compromises your machine.
According to his analysis, malicious code was injected into Adform’s JavaScript file. It appears to be clipper malware, designed to hijack your PC’s clipboard. The researcher explains how the attack works:
- It scans the content copied to the clipboard for Bitcoin, Ethereum, and TRX wallet addresses using three regular expressions.
- It replaces those addresses with attacker-controlled addresses, which vary from one case to another.
- It repeats the operation every 3 seconds.
That last point is important: even if the user notices the address is wrong and copies it again, the script replaces it again three seconds later. This means you will carry out the cryptocurrency transaction to the hacker’s wallet, not the intended recipient.
Zero detections across 61 antivirus engines
The malicious file, whose SHA-256 hash is 02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55, is not detected by the 61 engines integrated into VirusTotal (see this page). That said, the script may now be clean, which is what the researcher seems to suggest: "It appears that Adform is aware of it, or that the attacker realized they had been exposed, because the malicious code seems to disappear right as I’m writing these lines."
"In addition to cryptocurrency fraud, they also log the user’s IP address, the website they came from (that is, the supply-chain component affected by the compromise), and the URL path.", Kevin Beaumont notes.
It’s yet another strong example of a supply chain attack, in a different style from what we usually see. In this case, Adform has not communicated publicly about it: we do not know how long this malicious script remained in place, but it appears to have been at least a week.
