Slow Fog: Udesk customer service script was implanted with malicious code that can steal user session data and replace recharge addresses

According to Slow Fog's disclosure, its security personnel discovered that the script udeskApi.2026-10-16.cached.js related to the Udesk customer service system was implanted with a malicious loader during routine threat intelligence checks. This loader hides the address through hexadecimal encoding and asynchronously loads the remote script deeps.js (sourced from udeskqlobal[.]com, note that the domain name starts with the letter q). This script reads accessible Cookies, localStorage, and sessionStorage on the page, intercepts form and login/authentication requests, and sends data to udeskqlobal[.]com/c.php. Attackers may use this to impersonate sessions or take over accounts. This data collection behavior is not restricted by the target site's rules, and unmatched pages may also be affected.

According to Slow Fog's analysis, this script also targets three types of sites: mgbx[.]com, bikingex[.], and bitxex[.]io, scanning the recharge page every 200 milliseconds and replacing identified recharge addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. At the same time, the script manipulates the clipboard API, replaces copy buttons, and intercepts copy events, making users see and copy tampered addresses. If users transfer funds to this address, the money will flow into the attacker's address.