Tampered Udesk customer-service script loads payload that steals sessions and swaps exchange deposit addresses

Summary

SlowMist reports that scripts associated with the Udesk customer-service system were injected with malicious code. A tampered Udesk SDK file (udeskApi.2026-10-16.cached.js) hex-decodes and loads a remote payload, deeps.js, from the typosquatted domain udeskqlobal.com (note "qlobal" with a q). The payload steals session data and submitted credentials from any page that loads it, and on targeted exchange deposit pages it replaces displayed deposit addresses and hijacks the clipboard so users send funds to attacker addresses.

Affected

• Websites, including crypto exchanges, that embed the affected Udesk customer-service script (sample udeskApi.2026-10-16.cached.js, SHA256 45b4e8f160d8d5177819f6c1dc67acc7abbdc65eeaffc909e668799dc778bcf6)
• Remote payload deeps.js (SHA256 57c1441c4f5bb3260981a2df64f9ff35f117abde0d8667c8c66a047880074c59)
• No fixed version stated; SlowMist advises site operators to stop distributing the affected scripts and restore an independently verified version

Impact

According to SlowMist, on every page that loads it the payload reads readable cookies, localStorage and sessionStorage, copies form fields (including account names, passwords and verification codes) and request bodies sent to login/auth/register/password URLs, and sends them to https://udeskqlobal.com/c.php (with an image-request fallback). This data collection runs before the site-specific check, so it is not limited to the targeted sites. On pages matching site rules for three exchange domains (mgbx.com, bikingex and bitxex.io), it scans every 200 ms, replaces BTC, EVM, TRON, Solana, LTC and DOGE deposit addresses with attacker-configured values, wraps navigator.clipboard.writeText, replaces copy buttons and intercepts copy events, so the displayed and copied address can both be the tampered value. SlowMist does not state a loss amount.

Recommended actions

• Site operators: check whether pages load the affected Udesk script or any resource from udeskqlobal.com (also search minified code for the hex-encoded loader URL), preserve evidence, block it, and restore a verified version; review hosting, CDN, build and tag-manager configuration.
• Revoke sessions and rotate tokens and passwords that were exposed on affected pages; removing the script tag does not remove hooks already installed in open documents.
• Exchanges: verify deposit addresses and recent deposit transactions against trusted backends.
• Enforce script source and integrity controls (CSP script-src, connect-src, img-src; SRI) and block udeskqlobal.com.
• Wallets and screening services: flag the attacker addresses listed in the indicators.

Source & attribution

This 0xCERT advisory summarises threat intelligence published by the SlowMist Threat Intelligence team (MistEye): https://slowmist.medium.com/threat-intelligence-udesk-loads-malicious-js-to-steal-data-and-alter-transfer-addresses-157f331a5b8b. Indicators, including file hashes, are copied from SlowMist's IOC list. Details may change; refer to the original source for the authoritative record.