Crypto Thieves Hiding Inside Ad Code

Adform, a digital advertising technology company whose tracking code runs across thousands of commercial websites, confirmed that attackers modified one of its JavaScript files on July 27, 2026, according to The Hacker News.

The file, once compromised, silently replaced legitimate cryptocurrency wallet addresses with attacker-controlled ones. Anyone who copied a Bitcoin, Ethereum, or Tron address on an affected page that day may have pasted a different destination entirely, without any visible warning. Independent researcher Kevin Beaumont noted that even re-copying a wallet address did not help: the script kept overwriting it.

This is a supply chain attack (where compromising one shared resource gives attackers access to every downstream site using it). Adform's tracking script can run unconditionally across entire websites, so a single tampered file reached unrelated sites without those sites being individually breached. Think of it like a contaminated ingredient distributed to hundreds of restaurants at once.

The script also rewrote addresses typed directly into form fields, not just clipboard content. It attempted to phone home to an external server with page details from each visitor.

Adform says no evidence confirms that visitor IP addresses were transmitted, though it acknowledged the capability existed in the code. How many sites carried the file, how many visitors were exposed, and whether any funds were stolen remain unknown.

What you should do: If you copied a cryptocurrency wallet address on any website on July 27, do not send funds to it without re-verifying the address through a trusted, separate source. Clear your browser cache now. Before sending any crypto transfer, always verify the destination address character by character against the original source.

Palo Alto Networks' Unit 42 has documented a Chinese-speaking operator who used the open-source Hermes Agent framework to run DeepSeek as an autonomous attacker, according to The Hacker News.

After a single instruction sent over Telegram, the AI agent independently scanned for exposed systems, selected public exploits based on severity and apparent exploitability, and launched attacks against more than 460 targets with no further human input. The AI even abandoned unproductive targets and pivoted to new ones on its own.

The operation was partly exposed because the agent accidentally ran a public web server that left the operator's configurations, target lists, and session logs open to the internet.

Unit 42 confirmed three successfully exploited targets. The AI-led attacks on Langflow and n8n workflow platforms failed due to configuration mismatches on the targeted systems.

What you should do: If you run Langflow, n8n, Marimo, or NetScaler ADC or Gateway appliances, patch them now and remove unnecessary public internet access to these interfaces.

What Adobe Campaign Classic is: Adobe Campaign Classic is enterprise marketing software used by large organisations to manage and automate mass email, SMS, and direct mail campaigns.

What it is: A flaw in how the software checks whether a user has permission to perform certain actions allows an attacker to run arbitrary code (any program the attacker chooses) on the affected server, with no interaction required from a legitimate user. The flaw carries a CVSS (Common Vulnerability Scoring System — a standardised 0–10 scale for severity) score of 10.0: Critical. Patch today.

Who's at risk: Organisations running Adobe Campaign Classic prior to version 7.4.3 build 9398 on Windows or Linux. Exposure is highest for internet-facing installations.

CVSS: 10.0 (Critical) — Patch today.

Root cause: The software fails to correctly verify whether a requesting party is authorised before executing privileged operations. When authorisation checks are absent or bypassed, the server treats an attacker's request with the same trust as a legitimate administrator's. Adobe has not disclosed the precise technical mechanism publicly.

Attack vector: An attacker sends a crafted request to an affected Campaign Classic server without needing a valid account or any victim to click anything. The server, lacking proper authorisation checks, processes the request and executes attacker-supplied code under the permissions of whatever account the server runs as.

Detection strategies: Review server-side logs for unexpected process spawning from the Campaign Classic service account. Look for outbound connections to unfamiliar hosts originating from the application process. Flag any authentication or permission-related errors that appear in bulk or in unusual sequences.

Recommended actions:

1. Upgrade Adobe Campaign Classic to v7.4.3 build 9398 on all Windows and Linux deployments immediately.
2. Restrict network access to Campaign Classic servers to known, trusted IP ranges.
3. Monitor application logs for anomalous process execution or unexpected outbound traffic.

CISA issued an urgent alert after attackers disrupted more than 30 community water systems in Minnesota by targeting internet-exposed PLCs (programmable logic controllers — the industrial computers that manage physical equipment like pumps and valves), according to Bleeping Computer.

Attackers changed passwords to lock operators out, modified IP addresses to disconnect devices, and forced some utilities to switch to manual operations.

CISA's primary instruction is simple: remove these devices from direct public internet exposure immediately. If that is not possible, place them behind a VPN (a secure, encrypted access tunnel) or gateway device. Change all default passwords and restrict access to a known list of approved IP addresses.

This matters beyond utilities. The same principle applies to any remotely accessible device you manage — routers, smart home hubs, or office equipment. Anything reachable from the public internet without a barrier is a target.

What you can do today: Check whether any devices in your home or workplace are directly accessible from the internet. Your router's admin interface is a good place to start.

CISA, alongside 16 government agencies spanning four continents, has published updated minimum requirements for SBOMs (Software Bills of Materials — standardised ingredient lists that detail every component inside a piece of software), according to Dark Reading.

The updated guidance supersedes 2021 rules and introduces 10 new data fields, including digital signatures to verify an SBOM's authenticity and expanded dependency tracking that now requires listing not just direct components but also those components' own dependencies.

For everyday users, this matters because better software transparency means organisations can identify vulnerable components faster when the next major flaw surfaces.