#ThreatIntel #YARA #SupplyChainAttack rule ADFORM_TRACKPOINT_CLIPPER_2026 { meta: description = "Clipboard hijacker appended to Adform trackpoint-async.js" author = "Raze Security" date = "2026-07-28" reference = "s2.adform.net/banners/scripts/st/trackpoint-async.js" tlp = "CLEAR" strings: $key = /0x4d\s*,\s*0x33\s*,\s*0x77\s*,\s*0x54\s*,\s*0x77\s*,\s*0x30/ nocase $f1 = "_hookValue" ascii $f2 = "_scanInputs" ascii $f3 = "_scanText" ascii $c2 = "84.32.102.230:7744" ascii $path = "/p?h=" ascii $btc = "bc1qmplgt0hcg62jc2guz86wn2sms7tqrsulkkrrls" ascii $eth = "0xE7983E69df17079ADb0aD7b3458488Cac0dBc573" ascii nocase $re = "[1-9A-HJ-NP-Za-km-z]{33}" ascii $clip = "navigator.clipboard.readText" ascii condition: $c2 or $btc or $eth or ($key and 1 of ($f*)) or (2 of ($f*) and $clip and $re) or ($c2 and $path) }