SlowMist: Udesk Customer Service Script Infected with Malicious Code, Can Steal User Session Data and Replace Deposit Addresses

on October 27, SlowMist disclosed that during routine threat intelligence monitoring, its security team discovered a Udesk customer service script, udeskApi.2026-10-16.cached.js, had been injected with a malicious loader. The loader conceals an address using hexadecimal encoding to asynchronously load a remote script, deeps.js (sourced from udeskqlobal[.]com, note that the domain starts with the letter 'q'). This script reads accessible page cookies, localStorage, and sessionStorage, intercepts form submissions along with login and authentication requests, and forwards the data to udeskqlobal[.]com/c.php, allowing attackers to potentially hijack sessions or compromise accounts. This data collection activity is not bound by the target site's policies, meaning unmatched pages could also be affected.

According to SlowMist's analysis, the script specifically targets three categories of sites—mgbx[.]com, bikingex[.], and bitxex[.]io—scanning deposit pages every 200 milliseconds and replacing identified deposit addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. Furthermore, by wrapping the clipboard API, replacing copy buttons, and intercepting copy events, the script forces users to view and copy only tampered addresses. Should users proceed with transfers to these modified addresses, their funds will be diverted to the attacker-controlled addresses.

SlowMist recommends: preserve evidence and stop distributing the compromised scripts; revoke sessions and rotate tokens and passwords in a clean environment; verify deposit addresses and transaction logs via trusted backend systems; and restrict script loading and data exfiltration to udeskqlobal[.]com. Related IOCs have been incorporated into the MistEye threat detection engine.