Mediastreet
Tag

malware

Browsing
In News

Online ad firm Adform’s script compromised to steal cryptocurrency

No Comments

By Bill Toulas

Online advertising firm Adform suffered a supply-chain attack that delivered cryptocurrency-stealing scripts to websites using its ad platform, replacing wallet addresses copied to visitors’ clipboards with ones controlled by an attacker.

Adform is one of Europe’s largest adtech firms, providing a full-stack platform that includes Demand-Side Platform (DSP), Supply-Side Platform (SSP), ad servers, and management tools.

Security researcher Kevin Beaumont discovered the malicious activity, saying that it stemmed from ‘trackpoint-async.js,’ Adform’s JavaScript tracking script served from ‘s2.adform.net’ and embedded in every website using the advertising platform.

According to the researcher, the trojanized JavaScript continuously monitors the clipboard of users visiting websites that embed trackpoint-async.js.

If the script detected Bitcoin, Ethereum, or TRON wallet addresses, it replaced them with an attacker-controlled address to redirect cryptocurrency payments.

Compromised Adform script replacing crypto addresses
Compromised Adform script replacing crypto addresses
source: BleepingComputer

“This allows end-user devices of downstream websites to be compromised with crypto-stealing malware. Meaning if you visit example.com and they use Adform, example.com will compromise your device,” Beaumont explains.

The researcher also observed other malicious Adform-hosted scripts communicating with an attacker-controlled server at 84.32.102[.]230:7744, sending the victim’s IP address, referring website, and URL path.

Running the script through the VirusTotal scanning platform shows that it is not flagged as malicious by any of the available antivirus engines.

VirusTotal scan of the script comes clean
VirusTotal scan of the script gives clean result
Source: doublepulsar.com

Current status

Beaumont notes that the malicious code was removed from Adform’s tracking script soon after his discovery.

Adform confirmed its detected suspicious activity on July 27 and discovered a “cybersecurity threat.” The company said that it removed the malicious code and “took further measures to protect website visitors, our clients, and the Adform platform.”

“To our knowledge, the code was not designed to install software on a user’s device or establish persistence. It operated only while an affected webpage was open,” Adform says.

The company states that its services are now safe to use but its investigation continues.

Individuals who visited websites that embedded the “affected Adform technology on 27 July 2026” are impacted and the recommendation is to clear browser cookies to eliminate the malicious code.

“Adform has informed affected clients through dedicated communications and provided them with relevant information and recommended actions.”

Beaumont has shared a sample of the malicious script via Pastebin for security engineers to analyze.

BleepingComputer’s analysis of a sample stored on Archive.org also confirmed that a self-executing payload had been injected into the Adform tracking library served from the company’s infrastructure.

The malicious code was appended in obfuscated form at the end of the legitimate library and included a function that replaced any string matching a crypto wallet address format.

Apart from hijacking clipboard content, the malware can also rewrite wallet addresses on web pages. This way, if a payment address is displayed, it would be the attacker’s.

Beaumont says the malicious activity delivered through Adform has been ongoing for the past week without being detected. The oldest sample BleepingComputer could find was from from the Archive.org snapshot on July 26, taken at 23:29:03 GMT.

BleepingComputer has contacted Adform to request a statement regarding Beaumont’s findings and will update the story if we receive a response.

By Bill Toulas

Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.

Sourced from BLEEPINGCOMPUTER

 

Read More
By
In News

Busted: Huge malware operation targeted Google Chrome extensions

No Comments

By Andy Meek.

While she was performing some routine tasks one day that relate to her job of constantly hunting for digital threats online, security researcher Jamila Kaya stumbled across the first in a series of malicious Google Chrome extensions that would spark a two-month investigation and lead to the removal of more than 500 extensions by Google from its web store. Unfortunately, more than 1.7 million Chrome users had already installed that first batch of extensions she found, which gave some urgency to this investigation — the results of which have been unveiled in a newly published report into what turned out to be a huge malware operation active for at least two years.

After her initial discovery, Kaya reached out to the Duo security team at Cisco, according to the report. She contacted them about a variety of Chrome extensions she found that infected browsers and would “exfiltrate data as part of a larger campaign.”

“These extensions were commonly presented as offering advertising as a service,” the report notes. “Jamila discovered they were part of a network of copycat plugins sharing nearly identical functionality. Through collaboration, we were able to take the few dozen extensions and utilize CRXcavator.io to identify 70 matching their patterns across 1.7 million users and escalate concerns to Google.”

The Duo team goes on to explain that bad actors are increasingly using legitimate internet activity to obscure their malicious actions, one of the most popular channels being the use of advertising cookies and the redirects within them. It’s a technique called “malvertising” that is surprisingly hard to detect. “Malvertising often occurs within other programs, acting as a vehicle for multiple forms of fraudulent activity, including ad-fraud, data exfiltration, phishing, and monitoring and exploitation,” the report continues. “Alternatively, it also emerges in multipart malicious campaigns that involve advertising collection and defraudment.”

The code within these malicious extensions would sometimes redirect users to an affiliate link on sites like Best Buy’s or Macy’s. Other times, the destination might be a download site for malware. The researchers said Google was responsive when they escalated the matter up to them, and a Google spokesman said that it always takes action when the research community alerts it to issues that violate the company’s policies. Moreover, Google said it performs “regular sweeps to find extensions” similar to these that use comparable techniques, code, and behaviors.

Feature Image Credit: Valentin Wolf/imageBROKER/Shutterstock

By Andy Meek

Andy is a reporter in Memphis who also contributes to outlets like Fast Company and The Guardian. When he’s not writing about technology, he can be found hunched protectively over his burgeoning collection of vinyl, as well as nursing his Whovianism and bingeing on a variety of TV shows you probably don’t like.

Sourced from BGR

 

Read More
By