Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites

Adform detected on July 27, 2026 that an ad-serving JavaScript file had been tampered with to silently replace cryptocurrency wallet addresses in users' browsers, redirecting payments to attacker-controlled wallets; Adform removed the code, notified customers and authorities, and the report highlights risks of third‑party JavaScript and recommends SRI, CSP, script auditing, and real-user monitoring.