GoKawiilOnline ads provider Adform was hacked. On July 27, the company began serving ads containing malicious code. The company says in its latest annual report that its serves 1.5 billion ads to people's devices daily.
According to security researcher Kevin Beaumont, who first revealed the incident , some of the code that Adform used to load its ads on its customers' websites was maliciously altered. The code was designed to trigger when it loaded in a victim's web browser.
The malicious code replaced a victim's crypto wallet address in their computer's clipboard with crypto wallet addresses controlled by the hacker. The code replaces the crypto addresses in the clipboard every three seconds, all but guaranteeing that the victim will inadvertently paste in the attacker's crypto wallet address and send their crypto to the hacker instead of its intended destination.
Per Beaumont's blog:
"This allows end user devices of downstream websites to be compromised with crypto stealing malware. Meaning if you visit example.com and they use Adform, example.com will compromise your device."
If you've ever needed another reason to use an ad-blocker, this is it. By blocking ads, you can prevent pervasive tracking, surveillance, and yes, even malware, from landing on your computer.
Adform has now disclosed the breach , but the company didn't say how it was initially compromised or how many people may have been affected. When I reached out to the company with questions about the incident, a spokesperson referred me instead to its public statement.
Per its statement, Adform said it was still investigating if the hackers also took information about which websites a person visited; Adform said the code suggests this was possible.
I went to check out Adform's statement but couldn't at first, in large part because my ad blocker ( uBlock Origin on desktop; Filtr/Wipr on iPhone) prevented Adform's entire domain from loading. Even had I visited a website that contained the malicious Adform code, this shows my ad blocker would have prevented the code from loading.
Practice safe browsing, use an ad-blocker .
... continue reading