Udesk Script Injection Could Put Crypto Deposits and Account Data at Risk

SlowMist flagged malicious code injected into scripts connected to Udesk's customer support system, warning that it could expose account credentials and redirect crypto deposits. The risk applies to users funding accounts through websites that load the code.

The sample can collect cookies, information held in browser local and session storage, and sensitive details submitted in forms or authentication requests. SlowMist warned that those data could expose user sessions or account credentials. The code may also replace deposit addresses shown on certain websites and change clipboard contents, potentially directing a pasted deposit address to an attacker-chosen destination.

SlowMist urged affected websites to stop loading the script and restore a trusted version. It also recommended checking for data sent out from the site, revoking sessions that may have been exposed, and changing related credentials from a clean environment. Users should verify deposit addresses through a trusted channel and review transaction records, the firm said.