JavaScript tied to Udesk, a customer service chat widget that websites embed on their pages, carried code that collected visitors’ login data and replaced crypto deposit addresses on at least three trading sites, according to blockchain security firm SlowMist.
SlowMist published its analysis on Tuesday after its team spotted the code during routine threat intelligence work. The firm said its MistEye monitoring service pushed alerts to its customers.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
How the Script Worked
The tampered file, udeskApi.2026-10-16.cached.js, hid a short loader after the widget’s normal code. Its target was written in hexadecimal, so a search for the plain-text domain could miss it. Decoded, it pulled a second script, deeps.js, from udeskqlobal[.]com. SlowMist advised keeping that spelling, with a q, intact when searching logs.
Once running, the payload read cookies and browser storage, copied whatever users typed into forms, and copied the contents of requests whose web addresses contained words such as login, signup or password. It shipped that data to a server on the same domain. SlowMist said attackers could use it to impersonate users or take over accounts.
That collection was not limited to the three targeted sites. SlowMist wrote in the report that “even when the hostname does not match any of the three site-specific rules, the script first enters the data collection path and installs hooks.” The chat window’s iframe offered no shelter either: “The use of an iframe for the customer service chat window does not automatically isolate scripts loaded into the host page.”
Six Substitute Wallets
A second module switched on only for MGBX, Biking Exchange and BitxEX. On their deposit pages, the script checked every 200 milliseconds and swapped displayed addresses for one of six substitute wallets, covering Bitcoin, EVM chains, Tron, Solana, Litecoin and Dogecoin. It also rewrote copied text through three separate routes, so users comparing a pasted address with the page “may see the same tampered value,” the firm wrote.
SlowMist did not say how the code entered the Udesk script, how many sites loaded it, or whether any funds were sent to the substitute addresses.
The firm told businesses still loading the scripts to “stop distributing them, address exposed credentials, and verify deposit destinations against trusted backends and transaction records.” It added that deleting the script tag “does not revoke hooks and timers that have already been installed,” and advised closing affected pages and rotating passwords and tokens from a clean environment.
Third-party code has hit crypto users before. In December 2023, a tampered version of Ledger’s Connect Kit library drained roughly $500,000 from users of dApp front-ends including SushiSwap and Zapper.
Related Listen: Why the Theft of $100 Million From Ledgers Took ‘Months of Research and Development’
The post Hidden Code in Udesk Chat Script Swaps Crypto Deposit Addresses, SlowMist Says appeared first on Unchained.