Adform Script Poisoning Swaps Crypto Wallet Addresses on Client Sites, Leading to Theft
What Happened — Attackers compromised a JavaScript file served by advertising‑technology provider Adform. The malicious script rewrote Bitcoin wallet addresses embedded in pages that loaded the script, redirecting payments to attacker‑controlled wallets. Adform detected the tampering on July 27 2026, removed the code, and notified affected clients.
Why It Matters for Compliance & Audit Readiness
- This is a classic third‑party supply‑chain breach that tests the effectiveness of SOC 2 vendor‑management controls (CC6.1 – Monitoring of Subservice Organizations).
- Continuous evidence of due‑diligence (e.g., third‑party code integrity scans, change‑control logs) is essential to demonstrate a defensible audit trail.
- Leveraging Verisq’s Vendor Risk capability provides automated monitoring of ad‑tech providers, turning alerts into audit‑ready artifacts.
Who Is Affected – Digital advertisers, e‑commerce sites, and any online property that integrates Adform’s ad scripts (broadly across retail, media, and SaaS sectors).
Recommended Actions – Map the incident to SOC 2 CC6.1 controls, collect code‑integrity logs as evidence, enforce signed script delivery (SRI/Subresource Integrity), and add Adform to your continuous third‑party monitoring program. Source: The Hacker News
Technical Notes – The attack leveraged a supply‑chain compromise of a hosted JavaScript asset; no CVE was disclosed. The malicious code performed client‑side DOM manipulation to replace hard‑coded Bitcoin addresses with attacker‑controlled ones, resulting in direct crypto theft. Source: The Hacker News