SlowMist: malicious Udesk script loads from udeskqlobal.com to steal sessions and swap crypto deposit addresses
Blockchain security firm SlowMist published threat intelligence on 27 October 2026 reporting malicious code injected into scripts associated with the Udesk customer service system. A tampered udeskApi script loads a p…
- First reported
- Reports
- 1
Source: x.com · published
What happened
SlowMist, a blockchain security firm, published threat intelligence on 27 October 2026 about malicious code injected into scripts associated with the Udesk customer service system. A tampered udeskApi script loads a payload from udeskqlobal.com, spelled with a "q" rather than a "g". That payload collects cookies, local and session storage and information submitted through login forms, and sends it to udeskqlobal.com/c.php. On certain crypto exchange deposit pages, it also replaces displayed deposit addresses and hijacks the clipboard so a copied address is swapped for one controlled by the attacker. SlowMist says the malicious domain imitates Udesk's name, and it does not accuse Udesk itself.
How the scam works
A website that embeds a third-party support widget runs that widget's code with the same access as its own. SlowMist says the loader at the end of the script was hidden, written in hexadecimal so a plain search for the domain would miss it, and it inserts a second script from the look-alike domain. Because the script runs inside the host page, it can read data the page can reach and watch what users type.
SlowMist describes two behaviours. First, session and credential theft: the code reads cookies, local storage and session storage and hooks forms and login requests, which could expose sessions and account credentials. Second, deposit-address tampering: on specific websites it swaps a deposit address shown on screen and alters what is copied, so a user pasting an address may send funds to the attacker instead of the exchange. Users who compare the pasted address with the one on screen may see the same swapped value.
SlowMist's recommendations are aimed at site operators: stop serving compromised scripts and restore trusted versions, investigate data exfiltration records, revoke exposed sessions and rotate credentials from a clean environment, and verify deposit addresses and transactions through trusted channels.
Source
SlowMist, "Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Deposit Addresses", post on X (27 October 2026).
SlowMist's full analysis, linked from its 27 October X post, is at https://slowmist.medium.com/threat-intelligence-udesk-loads-malicious-js-to-steal-data-and-alter-transfer-addresses-157f331a5b8b and lists the domain and wallet addresses.
Red flags
- A deposit address that differs from the one in your exchange account's official records or app.
- An address that changes on screen or after you copy it.
- Unexpected requests to log in again on a site that normally keeps you signed in.
- A script loaded from a domain that mimics a vendor's name, such as udeskqlobal.com.
- A copied wallet address that doesn't match what you selected.
If you were targeted
- 1Before sending crypto, check the first and last characters of the pasted address against a trusted source such as your exchange's app, and send a small test amount first.
- 2Don't rely on a copy button alone; verify the address on a second device or channel.
- 3Exchange and site operators should stop serving the affected scripts, restore trusted versions and block udeskqlobal.com.
- 4If you may have used affected pages, log out everywhere, change passwords and revoke sessions from a clean device.
- 5Check your transaction records for payments to unexpected addresses and report losses to the platform and police.