Malicious Udesk-Linked JavaScript Targets Crypto Deposits

SlowMist has identified malicious JavaScript embedded in a customer-service script associated with Udesk that can steal browser session data and replace cryptocurrency deposit addresses. According to the security firm’s technical analysis, the compromised udeskApi.2026-10-16.cached.js sample loads a second payload called deeps.js from the lookalike domain udeskqlobal.com. SlowMist has not established how the malicious code entered the Udesk-related resource or how many websites loaded it.

The payload creates two distinct exposure paths. Its data-stealing functionality can read accessible cookies, localStorage and sessionStorage, while also intercepting form submissions and authentication-related requests. SlowMist found that account names, passwords and verification codes entered into affected pages could be copied and transmitted to an attacker-controlled endpoint. HttpOnly cookies are not accessible through this mechanism, but reusable session tokens stored elsewhere could potentially enable account impersonation.

Deposit Addresses Can Change on Screen and Clipboard

The cryptocurrency-specific module is narrower. SlowMist found hostname rules targeting MGBX, Biking Exchange and BitxEX, combined with checks for pages containing terms such as deposit, recharge or assets. When its conditions are satisfied, the script scans the page every 200 milliseconds and replaces recognized crypto addresses with attacker-configured destinations. The identified addresses cover Bitcoin, EVM networks, TRON, Solana, Litecoin and Dogecoin.

The manipulation extends beyond visible webpage content. The malware wraps the Clipboard API, replaces certain copy-button behavior and intercepts browser copy events. A user can therefore see a falsified address on the page and copy the same falsified value to the clipboard, defeating a simple visual comparison between the two. SlowMist stressed that the replacement logic does not verify the user’s selected blockchain network or address checksum.

The attack boundary resembles other compromises where malicious code reaches users through trusted software components rather than blockchain consensus. A compromised Injective SDK release previously exposed private keys through poisoned developer packages, while recent PHP vulnerabilities affecting Web3 infrastructure demonstrated how conventional web systems can create paths toward crypto losses. In the Udesk-linked case, however, the upstream point of compromise remains unconfirmed, so the evidence does not yet establish whether the failure occurred in a build pipeline, hosting environment, distribution system or another component.

Data Collection Extends Beyond Three Target Rules

A key technical distinction is that the hostname check appears after several data-collection hooks are installed. Sites outside the three address-replacement configurations could therefore still face session or credential exposure if they loaded the malicious payload. The three named rules primarily determine when cryptocurrency-address manipulation activates, not the full potential scope of data harvesting.

SlowMist published indicators of compromise including udeskqlobal.com, the deeps.js and c.php paths, six wallet addresses and SHA-256 hashes for both malicious samples. The firm recommends preserving affected resources, blocking distribution, revoking potentially exposed sessions and independently reconciling cryptocurrency deposit destinations. Similar endpoint-focused threats have appeared in a multi-month SlowMist phishing campaign that installed remote-control software, reinforcing how attackers increasingly target the infrastructure around wallets rather than the blockchain itself.

No confirmed loss total or complete victim list has been published. The technical evidence establishes the capability to capture sensitive browser data and redirect cryptocurrency transfers, but determining financial impact will require transaction-level reconciliation and identification of sites that actually loaded the affected scripts.