SlowMist identifies malicious Udesk scripts targeting crypto deposits

Blockchain security firm SlowMist has discovered malicious JavaScript injected into scripts associated with Udesk, a widely used third-party customer service chat widget. The compromised code is designed to collect sensitive user information, such as login credentials and session data, and can interfere with cryptocurrency transactions.

Analysts identified two specific JavaScript samples: ‘udeskApi.2026-10-16.cached.js’ and ‘deeps.js’. The attack utilizes a hidden loader script that decodes a hexadecimal URL to fetch a second malicious script from a misspelled domain, ‘udeskqlobal[.]com’, to evade detection.

The payload has the capability to replace cryptocurrency deposit addresses displayed on webpages or alter addresses when they are copied, potentially redirecting funds to attacker-controlled destinations. While the vulnerability has been observed on at least three trading platforms, SlowMist has not confirmed which specific platforms were affected, the duration of the exposure, or if any funds have been successfully stolen.