SlowMist Discovers Malicious Code in Udesk Customer Service Scripts

ChainCatcher report: According to SlowMist, its security team discovered during routine threat intelligence monitoring that a script related to the Udesk customer service system, udeskApi.2026-10-16.cached.js, has been injected with a malicious loader. This loader hides its target address using hexadecimal encoding and asynchronously loads a remote script, deeps.js, sourced from udeskqlobal[.]com (note the domain begins with the letter 'q'). The script reads cookies, localStorage, and sessionStorage accessible on the page, and intercepts form submissions and authentication requests, sending the collected data to udeskqlobal[.]com/c.php—enabling attackers to impersonate sessions or take over accounts. This data harvesting behavior is not restricted by the target site’s rules and may affect pages not explicitly matched. SlowMist analysis further reveals that the script targets three specific domains: mgbx[.]com, bikingex[.], and bitxex[.]io, scanning their deposit pages every 200 milliseconds and replacing detected deposit addresses with preconfigured BTC, EVM, TRON, Solana, LTC, and DOGE addresses. Additionally, the script wraps the clipboard API, replaces copy buttons, and intercepts copy events, ensuring users see and copy only the tampered addresses. If users transfer funds to these altered addresses, their assets will be sent directly to the attacker’s wallet.