How a Trusted Ad Script Became a Hidden Wallet Thief

According to a report by The Hacker News, attackers tampered with a JavaScript file served by the advertising technology company Adform. This file, normally used to track website visitors, was turned into a tool that silently swapped cryptocurrency wallet addresses. Anyone who visited an affected site on July 27 and copied a Bitcoin, Ethereum, or Tron address may have pasted a different address controlled by the hackers.

This is not a simple phishing email or a brute-force attack. It is a supply-chain compromise — the bad guys broke into a trusted third party, not the individual websites. Because Adform’s code runs on many customer sites, one poisoned file gave attackers access to hundreds of businesses at once. For Australian small and mid-sized businesses that rely on ad networks or embedded scripts, this attack shows how a single weak link can expose your customers to financial loss.

Why This Attack Is a Wake-Up Call for Cybersecurity

The method used here is clever and hard to spot. The malicious script didn’t install malware or steal passwords. It simply changed a few characters inside a wallet address the moment a visitor copied or typed it. The change happened in the browser, so the website owner and the visitor both saw what looked like a normal page.

This type of attack is called a "browser-side" or "supply-chain" attack. It exploits the trust we place in external services. Many Australian businesses load dozens of third-party scripts — for analytics, ads, chatbots, payment forms. If any one of those scripts is compromised, attackers can manipulate what happens on your site without ever touching your server. The Adform incident is a clear example of why cybersecurity can no longer stop at your own firewall. You must also consider the security of every tool you embed.

What This Means for Australian SMBs

Small and mid-sized businesses often use advertising platforms like Adform, Google Ads, or Facebook Pixel to reach customers. They also accept cryptocurrency payments or run donation pages. The Adform attack shows that a widely used ad script can become a delivery mechanism for theft. If your site uses any third-party JavaScript that handles or displays financial data, you are at risk.

For Australian businesses, the stakes are high. Cybercriminals target any site that touches money, and a script that swaps wallet addresses can redirect payments to criminal accounts. Even if you don’t deal in crypto, the same technique could be used to steal credit card numbers, passwords, or personal information. The lesson is clear: trust, but verify. Every third-party script on your website is a potential door for attackers.

What You Can Do Now

  • Review all third-party scripts your website loads. Disable any that are not essential, especially those that handle financial transactions or user input.
  • Implement a Content Security Policy (CSP) that restricts which scripts can run on your site. This can block malicious code even if a trusted provider is compromised.
  • Clear browser cache and instruct your customers to do the same after any security incident. Malicious scripts can remain cached and continue to run even after the original code is fixed.
  • Manually verify any cryptocurrency wallet address before sending funds. Use a separate channel (like a phone call) to confirm the address with the recipient.
  • Conduct a third-party security audit. Have a professional check which external scripts your site uses and whether they have been tampered with.

MS&VG helps Australian small and mid-sized businesses strengthen their cybersecurity posture. From script audits to incident response planning, we can guide you through the steps needed to protect your customers and your reputation.