A hacked ad script just showed how fragile your marketing stack really is
A single compromised ad-tech script hit every site that had embedded it, with no phishing email and no local weakness. Here's the lesson for your own domain.
By David Lara, Founder
Founder-reviewed ·How we research and correct articles
One compromised ad-tech script reached every site that had already embedded it — no phishing email, no site-side vulnerability, no action from any individual site owner.
On July 27, 2026, the online advertising firm Adform detected suspicious activity in one of its own scripts. Someone had appended malicious code to trackpoint-async.js, a tracking file served from s2.adform.net and embedded on a large number of client websites across the ad-tech industry. The payload watched visitors’ clipboards, and if it saw something shaped like a Bitcoin, Ethereum, or Tron wallet address, it quietly swapped in an attacker-controlled one — so a copied address pasted a moment later sent funds somewhere the visitor never chose.
Adform says it detected the activity, contained it, and removed the malicious code the same day. Independent reporting confirmed the code carried no persistence mechanism — it didn’t install anything on a visitor’s device, and it stopped acting the moment the affected page was closed. In pure technical terms, the incident was contained quickly and the payload was narrow.
That’s exactly why it’s worth reading closely regardless of whether you touch cryptocurrency at all.
Nobody had to do anything wrong
Every breach story in this space usually has a moment you can point to: someone clicked a link, someone reused a password, someone forgot to revoke a key. This one doesn’t have that moment for the affected sites. A site that had added Adform’s script correctly, months or years ago, with nothing misconfigured on its end, started serving a malicious payload to its own visitors the instant Adform’s file was altered at the source. No update was pushed to those sites. No developer touched anything. The next page load simply ran different code than the one before it, because the script tag was pointing at a URL, and the content behind that URL had changed.
That’s the mechanism worth internalizing: a third-party script tag isn’t a fixed piece of code you reviewed once and can forget about. It’s a live pointer to whatever the vendor is currently serving, re-fetched on every page load, running with exactly the same permissions as code your own team wrote. Reviewing it at integration time tells you nothing about what it does a year later.
The part that should worry a marketer, not just a security team
Ad-tech tags, analytics snippets, chat widgets, heatmap and session-replay tools, review-embed widgets, A/B testing scripts — a typical marketing site accumulates a dozen or more of these over a few years, usually added by whoever needed that specific tool at the time, rarely audited as a set afterward. Each one is a live, continuously updated program with full run-of-the-page access: it can read what’s typed into your forms, see what’s copied and pasted, and — this is the part that should land for anyone running outbound — sit on the same domain your prospects are asked to trust when they land on a landing page from your cold email campaign.
A domain’s reputation, in a mailbox provider’s eyes and in a human recipient’s eyes, isn’t scoped to just the mail you send. It’s the whole experience: the email, the click-through, the page it lands on, and everything that page silently loads in the background. A marketing site loaded with unaudited third-party scripts is a bigger attack surface sitting directly behind every link your outbound campaigns generate — and the Adform incident is a clean demonstration that the vendor doing the compromising doesn’t need to be obviously sketchy. Adform is a real, established ad-tech company that plenty of legitimate sites trust. That’s exactly the profile of vendor this kind of attack targets, because trust is the thing being exploited.
What to actually check on your own site
Auditing the scripts your own domain is trusting
Inventory every third-party script actually loading, not just the ones you remember adding
Browser dev tools (the Network tab, filtered to JS) will show you what's really being fetched on a page load — which is often a longer list than whoever built the page could recite from memory.
Ask what each one is actually for, and whether it still needs to be there
Analytics tools, chat widgets, and A/B testing scripts added for a campaign two years ago frequently outlive the reason they were added. Every one still loading is still a live trust relationship, whether or not anyone's using its dashboard.
Prefer vendors that support Subresource Integrity where your setup allows it
SRI pins a script to a specific cryptographic hash, so a tag fails to load rather than silently running altered code if the file behind the URL changes without your knowledge. It doesn't work for every kind of dynamically-updated script, but where it's supported, it closes exactly this class of attack.
Keep the count down on pages tied to your sending domain specifically
The landing pages your cold email links point to don't need the full tag sprawl of a content marketing blog. Fewer scripts on the pages that carry your outbound reputation is a smaller blast radius if any one vendor has a bad week.
None of this is exotic security advice — it’s closer to the same discipline as keeping an inventory of every OAuth-connected app touching your CRM, applied to the scripts your own site trusts instead of the integrations your CRM trusts. Both come down to the same question: do you actually know everything with live access to something you care about, or do you only know the parts you remember adding?
Where Norbelys keeps that surface small
This is one of the reasons Norbelys builds tracking, analytics, and audience management as one system your account controls end to end, rather than asking you to wire in a stack of separately-vendored tracking scripts and hope each one stays trustworthy indefinitely. Your open and click tracking runs as part of the platform you’re already paying for — not as one more third-party tag added to a landing page, with its own separate vendor risk to monitor for the life of the campaign.
If you’re running cold email campaigns that route through your own landing pages, the incident above is a good prompt to actually run the audit in the steps section, today, rather than filing this away as “someone else’s ad-tech problem.” And if part of what’s motivating a broader cleanup of your outbound stack is reducing the number of vendors with a hand in your sending domain’s reputation, see what’s included on every Norbelys plan — warmup, DMARC monitoring, and verified analytics ship built in, not as another script to audit next year. Start sending from a stack with fewer trust relationships to keep track of.
The Adform incident — quick answers
What actually happened in the Adform incident?
On July 27, 2026, attackers appended malicious code to trackpoint-async.js, a tracking script Adform serves to client websites. The code watched visitors' clipboards and swapped copied Bitcoin, Ethereum, or Tron wallet addresses for attacker-controlled ones. Adform detected and removed the code the same day.
Did affected sites need to have done anything wrong for this to hit their visitors?
No. Sites that had correctly embedded Adform's script began serving the altered version automatically, the moment Adform's own file changed at the source. No site-side vulnerability or misconfiguration was required.
Does this only matter if my site or campaigns touch cryptocurrency?
The specific payload targeted crypto wallet addresses, but the mechanism — a single compromised vendor script instantly reaching every site that trusts it — applies to any third-party tag with page-level access, including analytics, chat, and marketing tools that have nothing to do with crypto.
What's the actual fix for a marketing team, not a security team?
Inventory every third-party script actually loading on pages tied to your sending domain, remove ones no longer earning their access, and keep the count especially low on the landing pages your outbound campaigns link to.