Adform compromised to serve crypto stealer via supply chain attack

Malicious JavaScript (trackpoint-async.js) delivered via Adform's s2.adform.net modifies clipboard cryptocurrency addresses (BTC, ETH, TRX) to attacker-controlled wallets, polls every ~3 seconds to persistently replace recopied addresses, and exfiltrates user IP and referrer data to 84.32.102.230:7744. Observed IoCs include 84.32.102.230, s2.adform.net, and https://s2.adform.net/banners/scripts/st/trackpoint-async.js; the reporter notes the script was active for about a week and may be being removed.