Cointelegraph’s malicious pop-up, which promoted a fake token airdrop during the June 2025 hack, was distributed through a JavaScript payload embedded in its advertising infrastructure.

Quotes that support claims

Scam Sniffer traced the exploit to a JavaScript payload embedded via the site’s advertising infrastructure.

Per several reports on social media, a malicious JS script was likely added to CT’s advertising system to display a fabricated token price, and promised each participant nearly $5,500 worth of tokens if they connected their wallet to the site.