It sounds a little implausible at first, but Adform serves like a billion views on European consumer websites. For example, a state gambling monopoly: https://mstdn.social/@GossiTheDog@cyberplace.social/11701780... The attacker only has to get lucky once
Dang. That is wild, it seems like such a blatantly simple exploit, makes sense then.