Disclaimer: Information found on CryptoreNews is those of writers quoted. It does not represent the opinions of CryptoreNews on whether to sell, buy or hold any investments. You are advised to conduct your own research before making any investment decisions. Use provided information at your own risk.
CryptoreNews covers fintech, blockchain and Bitcoin bringing you the latest crypto news and analyses on the future of money.
Blockchain security firm SlowMist has discovered malicious JavaScript code embedded in the customer support widget used by Udesk. The widget, which is integrated into various websites, collects visitor credentials and replaces deposit addresses on at least three cryptocurrency exchanges.
The code was hidden within a modified file named udeskApi.2026-10-16.cached.js. The target address was encoded in hexadecimal format to evade simple domain name searches. Upon decoding, the script loaded a second file, deeps.js, from the domain udeskqlobal[.]com, noting the deliberate substitution of the letter ‘q’ for ‘g’, as highlighted by SlowMist experts.
Once executed, the malicious code read cookies and browser storage data, copied information entered into forms, and intercepted request contents where URLs contained the words “login,” “signup,” or “password.” All this data was sent to a server within the same domain. According to SlowMist, attackers could use the harvested data to impersonate users or hijack accounts.
Related Posts
The second module of the script activated only on the cryptocurrency platforms MGBX, Biking Exchange, and BitxEX. On deposit pages, the script checked the displayed address every 200 milliseconds and replaced it with a fraudulent one. This affected assets on Bitcoin, Ethereum Virtual Machine (EVM)-compatible blockchains, as well as Tron, Solana, Litecoin, and Dogecoin networks. Since the script could overwrite copied text, users comparing the pasted address with the one displayed on the page might still receive the substituted address.
SlowMist did not specify how the code entered the Udesk script, how many sites loaded it, or whether funds were sent to the fake addresses. SlowMist experts recommended that companies still loading these scripts cease distribution and verify deposit addresses against trusted backends and transaction records.
Last year, SlowMist experts discovered that attackers had altered the owner permissions of a Solana wallet, stealing over $3 million in cryptocurrency. When a user clicked a phishing link to a fake site and signed a transaction, the “assign” command silently overwrote the field with the attacker’s address.
