Security Firm: Scripts Tied to Udesk Customer Service System Injected with Malicious Code That Can Steal Data and Replace Deposit Addresses

October 27 — SlowMist disclosed that during a threat intelligence investigation it found that scripts related to the Udesk customer service system had been injected with malicious code. The analyzed JavaScript sample can collect cookies, browser local and session storage, and sensitive information from forms and authentication requests, potentially leading to the leakage of user sessions and account credentials.

The malicious script also replaces deposit addresses displayed on specific websites and tampers with clipboard contents, potentially causing deposit funds to be sent to addresses designated by the attacker. SlowMist recommends that affected websites stop loading the contaminated scripts and restore trusted versions, investigate data exfiltration records, revoke potentially leaked sessions, and change relevant credentials in a clean environment; users should independently verify deposit addresses and transaction records through trusted channels.