SlowMist identifies Web3 attack vectors across Udesk scripts, GitHub repositories, and iOS

Recent threat intelligence investigations have uncovered a coordinated series of attack vectors targeting the Web3 ecosystem through compromised customer service scripts, malicious developer repositories, and sophisticated iOS exploit chains. According to security firm SlowMist, threat actors are increasingly utilizing stealthy deployment mechanisms to extract sensitive information, hijack user sessions, and alter cryptocurrency transfer addresses ^{1 2 3}.

Malicious Injection in Udesk Scripts

On Oct. 27, SlowMist reported the detection of an attack involving malicious code injected into scripts associated with the Udesk customer service system ¹. During routine threat intelligence operations, security personnel obtained two JavaScript samples, identified as udeskApi.2026-10-16.cached.js and deeps.js ¹. Analysis of these samples revealed significant risks to user data and business operations ¹.

The malicious scripts were designed to collect session data and sensitive information submitted by users on web pages ¹. Furthermore, the code was capable of modifying deposit addresses and copied content based on specific site rules ¹. The first capability allows attackers to impersonate users through hijacked login sessions or assume full control over their accounts ¹. The second capability presents a direct financial threat, as it can trick users into transferring funds to substituted recipient addresses controlled by the attackers ¹.

The attack begins at the customer service script's loading entry point ¹. Within the udeskApi.2026-10-16.cached.js file, which handles legitimate features like chat iframes and visitor tracking, a standalone function decodes strings to create a script element ¹. This element silently loads a remote payload from a deceptively named domain, udeskqlobal.com ¹. Once the deeps.js payload is loaded, it reads the current hostname and generates configurations based on three specific site rules ¹. However, data collection occurs even if the hostname does not match these rules, broadening the scope of the impact ¹. The script harvests accessible Cookies, localStorage, and sessionStorage, prioritizing valid login tokens ¹. It also intercepts form submissions and authentication requests to capture account names, passwords, and verification codes ¹. All stolen data is subsequently transmitted to a fixed receiving endpoint ¹.

Weaponized Web3 Interview Repository

On Oct. 23, SlowMist disclosed findings regarding a malicious GitHub repository named sol-live, which masqueraded as a Solidity interview practice project ². The repository's documentation presented eight practice questions, claiming each would take 5 to 10 minutes to complete ². This facade was designed to lower the guard of developers ².

The project concealed a download-and-execute command within the Visual Studio Code workspace settings file, located at .vscode/settings.json ². To reduce visibility, the attackers inserted hundreds of spaces before the malicious command and utilized file exclusion rules to hide the .vscode directory from the editor's file explorer ². When a developer launches a terminal using the custom configurations defined by the project for macOS, Linux, or Windows, the malicious command is triggered ².

In the macOS and Linux execution chains, the command operates in the background ². It checks for Node.js and npm environments, installing them via an official installer if necessary ². It then writes and executes a loader script that sends a request to a fixed address and dynamically executes the returned JavaScript ². This payload, an obfuscated script of approximately 4 MB, launches three background processes ². These processes are responsible for browser data theft, file scanning and uploading, and remote control ². The data collection targets include browser login databases, wallet extension storage, macOS Keychain files, local files, and clipboard contents ². The execution chain runs with the current user's privileges and bypasses the need for administrator authorization ².

DarkSword iOS Exploit Escalation

Earlier, on Oct. 19, SlowMist published an analysis of the DarkSword Trojan backend and its associated iOS attack chain ³. The DarkSword exploit chain, previously detailed by the Google Threat Intelligence Group, targets iPhones running iOS 18.4 through 18.6.2 ³. The exploit is triggered simply by opening a specific page in the Safari browser, requiring no further interaction from the user ³. The ultimate goal of the exploit is to steal files, Keychain data, and keyboard input, with a primary focus on three specific cryptocurrency wallet applications ³.

The exploit chain utilizes six Common Vulnerabilities and Exposures (CVEs), three of which were zero-days actively exploited in the wild when initially observed ³. Following the public disclosure of the chain's code in March 2026, an operational package named DarkSword-PROV2 appeared on GitHub in July 2026 ³. This repository contained a complete deployment suite, including the exploit chain, a payload delivery server, an administrative panel, and a database ³.

By late September 2026, this toolkit was deployed online ³. The administrative panel for the attack infrastructure revealed significant scale ³. The dashboard displayed 6,115 total visits within a rolling seven-day window, 57 compromised devices, 10,125 total theft records, and 143,802 iOS logs ³. The victim devices were distributed globally, including locations in Australia, Malaysia, Latvia, South Korea, Ukraine, China, and Hong Kong ³. The panel tracked the attack process from page visits to data exfiltration, showing that out of 20,187 page visits over a 30-day period, 1,187 exploit attempts were made, resulting in 9 successful data exfiltrations ³. The stolen data categories listed on the panel included digital wallets, browser data, system reports, Keychain data, and communication logs ³.

Security Implications

The convergence of these threat reports highlights a multi-faceted approach by attackers to compromise cryptocurrency assets. The Udesk script injection demonstrates the risks associated with third-party service integrations on web platforms, where a single compromised script can jeopardize the security of all interacting users ¹. The weaponized GitHub repository underscores the vulnerability of the developer supply chain, exploiting common development tools and environments to silently deploy data-stealing malware ². Finally, the deployment of the DarkSword iOS exploit chain illustrates the severe threat posed by zero-click vulnerabilities and the rapid commercialization of exploit toolkits following public disclosure ³.

What to Watch

Security professionals and Web3 participants must remain vigilant regarding the integrity of third-party scripts and open-source repositories. The rapid deployment of the DarkSword exploit chain toolkit suggests that attackers will continue to iterate on public vulnerabilities to target high-value cryptocurrency users. The industry will closely monitor for further patches from affected software vendors and the potential emergence of new infrastructure domains associated with these threat actors.