SlowMist Discovers Malicious Script in Udesk Altering Deposit Addresses

The SlowMist cybersecurity team has identified an attack involving the injection of malicious JavaScript code into the scripts of the Udesk customer service system. Based on the analysis of two files, researchers determined that the code could steal user data and replace deposit addresses on three cryptocurrency platforms.

Attackers discreetly embedded hidden code into the system, which loaded the malicious script deeps.js from a fake domain udeskqlobal[.]com – differing from the original by just one letter, q instead of g.

How the script worked

The malware operated in several stages. First, it read the browser's cookies, localStorage, and sessionStorage, attempting to steal active authorization tokens: this allowed access to user accounts without a password. Simultaneously, the script intercepted everything visitors entered into forms – names, passwords, confirmation codes, and data from login or registration requests. The collected information was sent to the attackers' server; if standard sending was blocked by browser protection, the code encrypted the data and sent it in a request to load a regular image.

SlowMist noted two details. Using a chat window in iframe format did not save sites: the malicious code still accessed data from the entire main page. And the collection of credentials occurred on all resources with the affected Udesk widget, not just on individual targeted sites.

Address replacement and clipboard

A separate module was responsible for replacing deposit addresses and intercepting copying. According to SlowMist, the code contained rules for three domains: mgbx[.]com, bikingex[.] and bitxex[.]io. The script checked the page URL and interface elements, then every 200 milliseconds searched for deposit addresses and replaced them with values set by the attackers.

The code provided addresses for six types of assets: BTC, EVM-compatible networks, TRON, Solana, LTC, and DOGE. Addresses were determined by character patterns, without checking the network selected by the user or other transaction parameters. This created a risk that the user would copy the substituted address and transfer funds directly to the attackers.

The script interfered with the clipboard in three ways: intercepting Clipboard API calls, replacing copy buttons, and altering the content of copy events. As a result, the fake address could end up in the clipboard even when the user tried to copy other text.

SlowMist urged companies using the affected scripts to cease their distribution and check systems for signs of compromise. Researchers also recommended revoking compromised credentials and verifying deposit addresses against reliable server data and transaction records.

Previously, hardware crypto wallet manufacturer Keystone reported a client data leak.