SlowMist Discovers Malicious Code in Udesk Customer Service Scripts Targeting Multiple Platforms

Huo Xing Finance reports that, according to SlowMist, its security team discovered a malicious loader injected into the Udesk customer service system script udeskApi.2026-10-16.cached.js during routine threat intelligence monitoring. The loader hides its address using hexadecimal encoding and asynchronously loads the remote script deeps.js (originating from udeskqlobal[.]com—note the domain starts with the letter 'q'). This script reads cookies, localStorage, and sessionStorage accessible on the page, and intercepts form submissions and authentication/login requests, sending the data to udeskqlobal[.]com/c.php, enabling attackers to impersonate sessions or take over accounts. This data collection behavior is not restricted by the target site’s rules and may affect pages that do not match the intended targets. According to SlowMist’s analysis, the script also targets three types of sites: mgbx[.]com, bikingex[.], and bitxex[.]io, scanning their deposit pages every 200 milliseconds and replacing detected deposit addresses with preconfigured BTC, EVM, TRON, Solana, LTC, and DOGE addresses. Additionally, the script wraps the clipboard API, replaces copy buttons, and intercepts copy events, ensuring users see and copy only the tampered addresses. If users transfer funds to these addresses, their assets will be sent to the attacker’s wallet.