Tampered Udesk Script Swaps Crypto Deposit Addresses

Websites that load scripts tied to Udesk’s customer service widget should stop serving the affected files, end user sessions and check recent crypto deposits by hand, blockchain security firm SlowMist warned on 27 October. Its analysts found a tampered copy of the script that steals login data and, on three crypto exchange sites, swaps the deposit addresses users see and copy.

SlowMist said it “detected an attack involving the injection of malicious code into scripts associated with the Udesk customer service system” during routine threat intelligence work. It published a technical analysis on Medium and a summary on X. The firm has not said how the code got into the script, how many sites served it, or whether anyone lost money.

In brief

SlowMist found extra code at the end of a file named udeskApi.2026-10-16.cached.js that loads a second script, deeps.js, from the lookalike domain udeskqlobal[.]com.
The payload copies cookies, browser storage, form entries and login requests from any page that runs it.
On pages at mgbx[.]com, bikingex and bitxex[.]io, it replaces deposit addresses for six coin types and rewrites what users copy.
SlowMist’s advice: pull the scripts, revoke sessions, rotate credentials from a clean machine and check every deposit address against a trusted source.

Five steps SlowMist wants site operators to take now

SlowMist’s recommendations come in a set order. First, operators that still load the affected scripts should save the actual responses, request chains, cache data and timestamps, then block the files as soon as possible and restore independently checked versions. It also says they should inspect hosting, CDN, build and tag management settings.

Second, teams should search their logs for the malicious domain, both file paths and the two file hashes. Because the loader hides its address in hexadecimal, a search for the plain domain name can miss it, so SlowMist says to search for the encoded form as well.

Third, the affected pages, including app WebViews, should be closed completely so old code cannot reload. Sessions should be revoked and tokens and passwords rotated “from a clean environment”. The firm warns that “Removing the script tag does not revoke hooks and timers that have already been installed.”

Fourth, operators should verify original deposit addresses, related transactions and actual transfer destinations through trusted channels. Fifth, they should tighten script source and integrity controls and check the connect-src and img-src rules in their content security policy, blocking traffic to udeskqlobal[.]com.

How the tampered script worked

According to SlowMist, the Udesk file looks normal for most of its length, with code for the chat button, chat window and visitor tracking. A short function at the end decodes two hexadecimal strings and adds a script tag pointing to https[:]//udeskqlobal[.]com/deeps.js. The domain swaps the “g” in “global” for a “q”.

Once loaded, deeps.js reads the cookies the page can see, plus localStorage and sessionStorage, and sends them with the page address to a file called c.php on the same domain. It then watches for form submissions and for requests to addresses containing words such as login, signin, register or password, and copies their contents. If the normal upload fails, it retries by loading an image whose web address carries the data, cut to 8,000 characters. Cookies marked HttpOnly are out of its reach.

The address-swapping part runs only on matching sites. Every 200 milliseconds it scans for addresses that look like BTC, EVM, TRON, Solana, LTC or DOGE deposit addresses and replaces them with the attacker’s. It also hooks the browser’s clipboard function, replaces copy buttons and intercepts copy events. “As a result, even if users compare the address displayed on the page with the copied result, they may see the same tampered value,” SlowMist wrote. SlowMist’s MistEye monitoring service sent alerts to its customers.

Third-party scripts run with the host page’s full access

The detail that widens this case is where the exit check sits. SlowMist found that the cookie, storage and login collection all run before the line that ends the script on non-matching sites. In its words, “the script first enters the data collection path and installs hooks, then exits the address module.” Any site that embedded the tampered file, crypto-related or not, could have handed session data to the attacker. The exchange list only governs the address swap.

That is the core risk of third-party scripts. A support widget, analytics tag or chat tool loaded as a normal script runs with the same access as the site’s own code. SlowMist notes that putting the chat window in an iframe does not isolate a script loaded into the host page. Integrity checks on script files and strict outbound rules limit the damage when a supplier’s file changes underneath a site, which is why they sit in the firm’s last recommendation.

The case also echoes the AOMEI update hijack, where Google warned that fixing the server did not clean machines already infected. Here, removing the script does not undo hooks already running in an open page. For users, the lesson matches TSN’s coverage of malicious Electrum servers: what a screen shows is not proof of where funds will go, and comparing a pasted address with the displayed one may not help if both have been changed.

What remains unknown matters as much. SlowMist does not say whether Udesk’s own servers or a site’s cached copy was altered; the sample’s file name includes “cached” and a 16 October date, but the firm draws no conclusion from it. Udesk and the three exchanges had made no public statement that TSN could find on 27 October. The npm worm campaign JFrog reported this week is another reminder that code pulled from suppliers needs checking. More attacks are tracked in TSN’s ransomware and cyber attacks hub.