SlowMist phát hiện mã độc trong các script dịch vụ khách hàng Udesk nhắm mục tiêu nhiều nền tảng

The Huoxing Finance report, according to SlowMist, revealed that during routine threat intelligence investigations, its security team discovered a malicious loader embedded in the Udesk customer service system script udeskApi.2026-10-16.cached.js. This loader hides its address using hexadecimal encoding and asynchronously loads a remote script, deeps.js (originating from udeskqlobal[.]com; note the domain starts with the letter 'q'). The script reads cookies, localStorage, and sessionStorage accessible on the page, and intercepts form submissions as well as login and authentication requests, sending the data to udeskqlobal[.]com/c.php, allowing attackers to impersonate sessions or take over accounts. This data collection behavior is not restricted by the target site’s rules, and even pages that do not match may be affected. According to SlowMist’s analysis, the script also targets three types of sites: mgbx[.]com, bikingex[.], and bitxex[.]io, scanning their deposit pages every 200 milliseconds and replacing identified deposit addresses with preconfigured BTC, EVM, TRON, Solana, LTC, and DOGE addresses. Additionally, the script wraps the clipboard API, replaces copy buttons, and intercepts copy events, ensuring users see and copy only the tampered addresses. If users transfer funds to these addresses, their assets will be sent to the attacker’s wallet.