SlowMist: a tampered Udesk chat script steals login data and swaps crypto deposit addresses, even in copied text

A script tied to the Udesk customer-service chat system carried injected code that collects login data and swaps crypto deposit addresses, blockchain security firm SlowMist said on Tuesday 27 October in a threat intelligence report published on Medium at 10:06 UTC. SlowMist analysed two files, udeskApi.2026-10-16.cached.js and deeps.js. On the deposit pages of three exchange-style websites, the second file replaces both the address shown to the user and the address the user copies, so pasting and comparing no longer catches the swap. Udesk has not commented.

SlowMist also published the six receiving addresses written into the code. Two of them have already been used. Public blockchain records checked by Coindaro at 11:53 UTC on 27 October show that the TRON address received 7,000 USDT on 18 October and was emptied the same day. Nothing in those records says who sent the money or why, and SlowMist does not report any loss.

SlowMist found a hidden loader at the end of the Udesk script

Most of udeskApi.2026-10-16.cached.js is ordinary chat code: the customer-service button, the chat window, visitor tracking and messaging, according to SlowMist. After the main block ends, the file has one extra function. It decodes two strings, builds a script element from them and adds it to the head of the page.

The strings are written in hexadecimal, two characters per letter, so a search for a plain domain name finds nothing. Decoded, the first reads “script” and the second https[:]//udeskqlobal[.]com/deeps.js. SlowMist points out that the domain begins with “udeskq”, a q where a reader expects a g, and says the spelling should be kept as is when searching logs. The remote file loads asynchronously, without slowing the page.

The date in the file name is just part of the name. SlowMist does not say when the code was added, how it got into the file, or where the samples came from. The chat window itself runs in an iframe, but SlowMist notes that this gives no protection here: a script loaded into the host page runs with that page’s access, whatever the chat window does.

Deeps.js collects session data on every page it reaches

The payload starts by reading the site’s hostname and checking it against rules for three sites. SlowMist traced where the script stops for any other site, and found that the data-collection code runs before that check. So the theft of session data is not limited to the three targets. Only the address-swapping part is.

On start-up, deeps.js reads the cookies the page can see, plus everything in localStorage and sessionStorage, the places where many sites keep login tokens and profile data. Cookies marked HttpOnly are out of its reach, SlowMist says. The script adds the page address and origin and sends the bundle to udeskqlobal[.]com/c.php.

It then waits for more. When a form is submitted, it copies every non-empty field, which can include account names, passwords and one-time codes, and lets the submission go through as normal. It also wraps the browser’s fetch and XMLHttpRequest functions and copies the body of any request whose address contains words such as login, signin, auth, register, signup or password.

A valid session token can let someone act as the user without a password, which is why SlowMist warns of session impersonation and account takeover. If the upload to c.php fails, the script retries through an image request, cut to 8,000 characters. SlowMist adds a detail for anyone reading browser logs: a CORS error in the console does not mean the data stayed put, because the request can leave before the browser blocks the reply.

On three deposit pages, addresses are rewritten every 200 milliseconds

The three rules match mgbx[.]com and bitxex[.]io. SlowMist writes the third as “bikingex[.]”, with no ending, both in the rules and in its own text, so the full domain is not public. The rules have no start or end anchors, SlowMist says, so they can match more hostnames than those three exact names. They also look for words such as deposit, recharge and assets anywhere in the page address.

When the page and the address format match, the script scans five times a second and replaces any deposit address it recognises with one of six values set in the code, labelled BTC, EVM, TRON, Solana, LTC and DOGE. It goes only by the look of the characters. It does not check the network the user picked or the address checksum, and it may also rewrite ordinary order numbers that happen to look like addresses.

The copy step gets three separate traps. The browser’s clipboard function is wrapped so that anything a site writes there passes through the replacement routine first, on any page of a matching host. The page’s copy buttons are cloned and swapped for buttons that copy the last address the script replaced. And a copy listener on deposit pages puts that same address in the clipboard, whatever text the user had selected.

SlowMist also found a bug: one call looks for a text property in the wrong place and throws an error, which the script silently swallows. It does not stop the swap, because the scanning timer and the clipboard hooks are already in place by then.

No source says whether the three sites served the script to their users, for how long, or whether their operators know. None of them has commented in the coverage Coindaro found.

What the attacker addresses show on-chain

SlowMist lists the six addresses as indicators of compromise. Coindaro looked them up on public explorers at 11:53 UTC on 27 October.

The two used addresses were active on the same evening, two days after the date in the file name. The larger ETH payment came through the SwftSwap swap contract. These records show money moving, not whose money it was: the 7,000 USDT may come from a victim, a test by the attacker or something else. EVM addresses work on many chains, and only Ethereum was checked.

Why paste-and-compare fails against a tampered page

Address swapping is old. Clipboard malware, often called a clipper, runs on an infected computer and replaces any crypto address the user copies. Address poisoning, covered in our guide to fake airdrops and poisoned addresses, plants look-alike addresses in a wallet’s history. Against both, the usual advice is to compare the pasted address with the one the exchange shows.

That advice assumes the exchange page is honest. Here the code runs inside the page, so it writes both what the page shows and what the copy button produces. SlowMist says users comparing the two may see the same altered value. A useful check needs a source the script cannot touch, such as the exchange’s mobile app or a second device. Our explainer on how crypto address formats and networks work covers what to compare.

The case turns on outside code. Websites load ready-made scripts for chat, analytics or payments, and the browser gives them the same rights as the site’s own code. Change the file and every page that loads it runs the new version. SlowMist tells operators to inspect their hosting, delivery network, build and tag-management settings, but it does not say which of these was the entry point here, or how many Udesk customers received the altered file.

What to check if you used one of these deposit pages

SlowMist’s advice is written for site operators. For users, it comes down to these steps:

• Read the deposit address again in the exchange’s mobile app or on a second device, as well as on the web page.
• Send a small test amount first and wait until the exchange credits it before sending the rest.
• If you logged in to mgbx[.]com, bitxex[.]io or another site carrying the Udesk chat widget, log out of every session, then change your password and two-factor settings from a clean device.
• Revoke API keys and open sessions on those accounts, and look through the transaction history for transfers you did not make.

A hardware wallet adds one check the page cannot fake, because its own screen shows the address you are about to sign for. That only helps if you compare it with an address from a trusted channel. Our step-by-step hardware wallet setup guide explains how to read that screen. This point is Coindaro’s, not SlowMist’s.

For sites that embed Udesk

SlowMist tells operators still loading the affected files to keep a copy of what was actually served, with request chains, cache data and timestamps, before blocking them. It suggests searching logs for the domain, both paths and the file hashes, and for the hexadecimal string as well as the plain address. It lists SHA-256 hashes beginning 45b4e8f1 for udeskApi.2026-10-16.cached.js and 57c1441c for deeps.js.

Removing the script tag is not enough, SlowMist warns: hooks and timers already installed keep running until the page is fully closed. Sessions should be revoked and tokens and passwords rotated from a clean environment, and deposit addresses checked against back-end records. It also recommends script source and integrity controls and egress rules, including connect-src and img-src, that block udeskqlobal[.]com. The indicators have been added to its MistEye detection engine.

Udesk has not commented, and the main questions are open

Udesk has published no statement, and none appears in the English and Chinese-language coverage. TechFlow and ChainCatcher relayed SlowMist’s findings on 27 October without adding analysis of their own. Still unknown: how the file was altered, whether Udesk served it to all its customers, how long it was online, and the full name of the third site.

French and Italian readers who use small platforms can check them on the AMF and Consob warning lists before depositing. Our guide to avoiding crypto scams lists where to report a suspicious platform. The next things to watch are a statement from Udesk and any update from SlowMist on how the file was altered.