---
title: "SlowMist Detects Malicious Code Injected Into Udesk Scripts to Hijack Transfers"
description: "Attackers tampered with customer support scripts to harvest user credentials, steal session tokens, and swap cryptocurrency deposit addresses."
url: https://basisdesk.news/news/slowmist-udesk-malicious-js-crypto-transfer-theft
published: 2026-10-27T10:37:00.033Z
modified: 2026-10-27T10:37:00.033Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: []
tags: [SlowMist, Udesk, cybersecurity, supply-chain-attack, JavaScript-injection, phishing]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# SlowMist Detects Malicious Code Injected Into Udesk Scripts to Hijack Transfers

Attackers tampered with customer support scripts to harvest user credentials, steal session tokens, and swap cryptocurrency deposit addresses.

## At a glance

- **What happened:** SlowMist discovered malicious code injected into Udesk customer support scripts that steals login credentials and swaps crypto deposit addresses.
- **Why it matters:** The third-party script compromise allows attackers to take over user sessions and divert deposited cryptocurrency to adversary-controlled wallets.
- **Who is affected:** Web platforms using Udesk customer support scripts and their end users.
- **What's next:** No next step announced.
- **Primary source:** [Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Transfer Addresses](https://slowmist.medium.com/threat-intelligence-udesk-loads-malicious-js-to-steal-data-and-alter-transfer-addresses-157f331a5b8b?source=rss-4ceeedda40e8------2) — SlowMist

## Key points

- Attackers injected malicious JavaScript into Udesk customer service scripts to steal credentials and alter crypto deposit addresses.
- A secondary remote payload loaded from udeskqlobal[.]com hooked into form submissions, local storage, and authentication APIs.
- Deposit address modifications were executed alongside data exfiltration to redirect outbound customer asset transfers.

## Editorial remark

- **Context:** Supply chain attacks against third-party software widgets, including customer support and chat tools, remain a persistent vector for compromising Web3 web applications.
- **Impact:** End users utilizing platforms with integrated Udesk services face session hijacking, credential theft, and unauthorized diversion of cryptocurrency deposits.
- **Watch:** Remediation statements from Udesk and technical post-mortems identifying the total number of affected client websites.

Security firm SlowMist revealed on Oct. 27 that attackers injected malicious code into scripts tied to the Udesk customer service platform [1]. The breach enabled unauthorized data harvesting across integrated platforms and allowed operators to substitute cryptocurrency deposit addresses to divert customer funds [1].

According to SlowMist's threat intelligence analysis, the intrusion originated from compromised JavaScript files, including a cached asset named `udeskApi.2026-10-16.cached.js` [1]. This script dynamically decoded and loaded an external payload from `udeskqlobal[.]com/deeps.js` via an obfuscated loader [1]. Once embedded in the host page, the secondary script executed in the context of the embedding document, bypassing structural separation even when customer service chat windows ran inside nested iframes [1].

## Credential Theft and Address Substitution

The malicious payload systematically collected authentication data, browser cookies, and local session storage before attempting to alter user operations [1]. By wrapping native `fetch`, `XMLHttpRequest`, and form submission prototypes, the script intercepted sensitive fields—including usernames, passwords, and verification codes—targeted at authentication endpoints containing terms like `login`, `auth`, or `password` [1]. SlowMist noted that the data collection routines executed broadly across host sites, independent of site-specific configurations [1].

Beyond data exfiltration, the injected code modified deposit addresses and clipboard content based on site-specific logic, redirecting user asset transfers to attacker-controlled destinations [1]. All intercepted parameters were dispatched via asynchronous requests to an attacker endpoint at `udeskqlobal[.]com/c.php`, with an image-request fallback to circumvent transmission errors [1]. Similar software supply-chain vectors were previously analyzed when [SlowMist uncovers backdoor hidden in fake Web3 interview repository](https://basisdesk.news/news/slowmist-uncovers-fake-web3-interview-backdoor) setups targeting developer infrastructure.

SlowMist stated that its threat monitoring arm, MistEye, distributed risk alerts across its client channels [1]. No formal timeline or remediation statement from Udesk was disclosed in the report [1].

## Sources

1. [Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Transfer Addresses](https://slowmist.medium.com/threat-intelligence-udesk-loads-malicious-js-to-steal-data-and-alter-transfer-addresses-157f331a5b8b?source=rss-4ceeedda40e8------2) — SlowMist, 2026-10-27

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai