SlowMist Flags Udesk Chat Script Swapping Deposit Addresses on 3 Crypto Exchanges

Udesk Chat Script Carried Hidden Payload

A customer-support chat widget embedded on third-party websites was carrying hidden code that harvested visitors' login data and rewrote crypto deposit addresses on at least three crypto exchanges, blockchain security firm SlowMist reported on Tuesday, October 27. The firm's team ran into the tampered script during routine threat intelligence work, and its MistEye monitoring service pushed alerts to affected customers. The file at issue, udeskApi.2026-10-16.cached.js, is the script Udesk ships so websites can place a support button and chat window on their pages. SlowMist raised the alarm in an advisory posted on X and released a full technical write-up the same day.

@SlowMist_Team · X post

Advisory posted on X.

View on X

The data-collection routine ran on every page that loaded the script, before any check against site-specific rules, so any site embedding the widget could leak credentials. SlowMist noted that the chat window's iframe offered no protection, because scripts loaded into the host page still read its data. The address-swapping module was narrower: it activated only against three domain rules matching MGBX, Biking Exchange and BitxEX. On the deposit, recharge and asset pages of those venues, the script scanned every 200 milliseconds and replaced displayed deposit addresses with one of six attacker-controlled wallet addresses spanning Bitcoin, Ethereum virtual machine chains, Tron, Solana, Litecoin and Dogecoin. It also rewrote copied text through three separate routes, so a user pasting an address elsewhere to compare it could be looking at the same tampered value on both ends. SlowMist did not say how the code entered the Udesk script, how many sites loaded it, or whether any funds actually reached the substitute addresses.

Hex Trick Hid the Attacker's Domain

The malicious loader sat at the end of the file, after the widget's normal code for the support button and chat window. Its command-and-control address was written in hexadecimal, so a plain-text search for the domain could miss it entirely. Once decoded, the loader pulled a second script named deeps.js from udeskqlobal.com. SlowMist stressed the spelling: the domain starts with a 'q', not the 'g' of 'global', and defenders searching logs should keep the exact string. As soon as deeps.js executed, it read cookies and browser storage and forwarded them, along with the page URL, to a server on the same domain. It then hooked form submissions and requests whose addresses contained words such as login, auth or password, copying account names, passwords and verification codes as users sent them. The firm wrote that stolen data of this kind could let attackers impersonate users or take over their accounts outright. On remediation, businesses still loading the affected scripts were told to preserve evidence first, stop distributing the files, revert to verified versions and review hosting, CDN and tag manager settings. After that, they should revoke potentially leaked sessions and rotate passwords and keys from a clean environment, then check deposit destinations against trusted backends and transaction records. SlowMist cautioned that deleting the script tag does not revoke hooks and timers already installed, so affected pages should be closed down. The report also published the malicious domain, file hashes and the six wallet addresses so operators can match them against their own logs.

The pattern here is a supply-chain compromise of shared infrastructure, not a breach of any single venue, and that is what makes the blast radius hard to bound: data collection ran before the site checks, so every page carrying the widget is in scope. The closest precedent is the tampered Ledger Connect Kit library in December 2023, which drained roughly $500,000 from users of front-ends including SushiSwap and Zapper. This case adds a nastier layer, because the clipboard rewriting defeats the copy-and-compare habit many users treat as protection. SlowMist's decision to publish file hashes and the six addresses gives operators a concrete check against their logs, and teams screening third-party dependencies can start with the basics covered in blockchain security audits.