-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0304 ============================================================ Advisory-ID: 0xCERT-2026-0304 Severity: High Published: 2026-10-27T10:06:23.000Z Updated: 2026-11-03T00:44:20.543Z Chains: Bitcoin, Ethereum, Solana, Other / Multi-chain URL: https://www.0xcert.com/advisory/0xCERT-2026-0304 Title: Tampered Udesk customer-service script loads payload that steals sessions and swaps exchange deposit addresses Summary - ------- SlowMist found malicious code in Udesk customer-service scripts that loads a payload from udeskqlobal.com, steals cookies, web storage and login submissions, and replaces deposit addresses and clipboard contents on targeted exchange pages. Sites should remove the script, rotate exposed credentials and block the domain. Details - ------- Summary SlowMist reports that scripts associated with the Udesk customer-service system were injected with malicious code. A tampered Udesk SDK file (udeskApi.2026-10-16.cached.js) hex-decodes and loads a remote payload, deeps.js, from the typosquatted domain udeskqlobal.com (note "qlobal" with a q). The payload steals session data and submitted credentials from any page that loads it, and on targeted exchange deposit pages it replaces displayed deposit addresses and hijacks the clipboard so users send funds to attacker addresses. Affected - - Websites, including crypto exchanges, that embed the affected Udesk customer-service script (sample udeskApi.2026-10-16.cached.js, SHA256 45b4e8f160d8d5177819f6c1dc67acc7abbdc65eeaffc909e668799dc778bcf6) - - Remote payload deeps.js (SHA256 57c1441c4f5bb3260981a2df64f9ff35f117abde0d8667c8c66a047880074c59) - - No fixed version stated; SlowMist advises site operators to stop distributing the affected scripts and restore an independently verified version Impact According to SlowMist, on every page that loads it the payload reads readable cookies, localStorage and sessionStorage, copies form fields (including account names, passwords and verification codes) and request bodies sent to login/auth/register/password URLs, and sends them to https://udeskqlobal.com/c.php (with an image-request fallback). This data collection runs before the site-specific check, so it is not limited to the targeted sites. On pages matching site rules for three exchange domains (mgbx.com, bikingex and bitxex.io), it scans every 200 ms, replaces BTC, EVM, TRON, Solana, LTC and DOGE deposit addresses with attacker-configured values, wraps navigator.clipboard.writeText, replaces copy buttons and intercepts copy events, so the displayed and copied address can both be the tampered value. SlowMist does not state a loss amount. Recommended actions - - Site operators: check whether pages load the affected Udesk script or any resource from udeskqlobal.com (also search minified code for the hex-encoded loader URL), preserve evidence, block it, and restore a verified version; review hosting, CDN, build and tag-manager configuration. - - Revoke sessions and rotate tokens and passwords that were exposed on affected pages; removing the script tag does not remove hooks already installed in open documents. - - Exchanges: verify deposit addresses and recent deposit transactions against trusted backends. - - Enforce script source and integrity controls (CSP script-src, connect-src, img-src; SRI) and block udeskqlobal.com. - - Wallets and screening services: flag the attacker addresses listed in the indicators. Source & attribution This 0xCERT advisory summarises threat intelligence published by the SlowMist Threat Intelligence team (MistEye): https://slowmist.medium.com/threat-intelligence-udesk-loads-malicious-js-to-steal-data-and-alter-transfer-addresses-157f331a5b8b. Indicators, including file hashes, are copied from SlowMist's IOC list. Details may change; refer to the original source for the authoritative record. References - ---------- - - https://slowmist.medium.com/threat-intelligence-udesk-loads-malicious-js-to-steal-data-and-alter-transfer-addresses-157f331a5b8b Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmrtDqMJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmdZYvwqkmbR+hdSBQ8v58muuo4I9AyBsKvt+U4X 8xE4bBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAA4lQD/SMymGod90iXkF0a3 L1F1VPaJdfx9n7tUQuNbQqdklPcBAOL/He3VGSz9AWqH7NE5qWyZM8S9kecM Z5ms0pEsFGMD =RV9z -----END PGP SIGNATURE-----