SlowMist Detects Malicious Code Injected Into Udesk Scripts to Hijack Transfers

Security firm SlowMist revealed on Oct. 27 that attackers injected malicious code into scripts tied to the Udesk customer service platform ¹. The breach enabled unauthorized data harvesting across integrated platforms and allowed operators to substitute cryptocurrency deposit addresses to divert customer funds ¹.

According to SlowMist's threat intelligence analysis, the intrusion originated from compromised JavaScript files, including a cached asset named udeskApi.2026-10-16.cached.js ¹. This script dynamically decoded and loaded an external payload from udeskqlobal[.]com/deeps.js via an obfuscated loader ¹. Once embedded in the host page, the secondary script executed in the context of the embedding document, bypassing structural separation even when customer service chat windows ran inside nested iframes ¹.

Credential Theft and Address Substitution

The malicious payload systematically collected authentication data, browser cookies, and local session storage before attempting to alter user operations ¹. By wrapping native fetch, XMLHttpRequest, and form submission prototypes, the script intercepted sensitive fields—including usernames, passwords, and verification codes—targeted at authentication endpoints containing terms like login, auth, or password ¹. SlowMist noted that the data collection routines executed broadly across host sites, independent of site-specific configurations ¹.

Beyond data exfiltration, the injected code modified deposit addresses and clipboard content based on site-specific logic, redirecting user asset transfers to attacker-controlled destinations ¹. All intercepted parameters were dispatched via asynchronous requests to an attacker endpoint at udeskqlobal[.]com/c.php, with an image-request fallback to circumvent transmission errors ¹. Similar software supply-chain vectors were previously analyzed when SlowMist uncovers backdoor hidden in fake Web3 interview repository setups targeting developer infrastructure.

SlowMist stated that its threat monitoring arm, MistEye, distributed risk alerts across its client channels ¹. No formal timeline or remediation statement from Udesk was disclosed in the report ¹.