🟠 High | Source: The Hacker News
Attackers compromised a JavaScript file distributed by advertising technology firm Adform, injecting code that silently replaced cryptocurrency wallet addresses in users’ browsers on 27 July 2026. Any visitor to an affected site who copied a crypto wallet address during that window may have unknowingly sent funds to an attacker-controlled address. The incident is a classic supply-chain attack targeting third-party scripts loaded by multiple customer websites simultaneously.
Security Architect’s Take: Audit your estate for third-party advertising or analytics scripts and enforce Subresource Integrity (SRI) hashes so browsers reject modified files. Additionally, review your Content Security Policy to restrict which external script domains can execute on your properties.
Original advisory: Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites