SlowMist has reported that attackers injected malicious JavaScript into scripts used by the Udesk customer support system, creating a supply-chain style risk for any website running the affected widget. Based on the firm’s analysis of two files, the code was able to collect sensitive browser and form data and, on some crypto platforms, alter deposit addresses shown to users.
The researchers said the incident went beyond a narrow attack on a few exchanges. According to SlowMist, credential harvesting could occur on all sites where the compromised Udesk script was installed, while a separate address-spoofing component was activated on specific cryptocurrency platforms.
What the malicious code was designed to capture
SlowMist said the injected JavaScript read browser cookies as well as localStorage and sessionStorage data. That gave attackers a way to steal active authorization tokens, which could potentially allow access to user accounts without requiring a password.
The code also intercepted information entered into website forms. SlowMist said the harvested data included names, passwords, verification codes, and contents from login and registration requests, along with Udesk account login details.
Researchers said the stolen information was sent to infrastructure controlled by the attackers. If a standard outbound request was blocked by browser protections, the script reportedly switched to an obfuscated method, embedding encrypted data inside what appeared to be a normal image-loading request.
Why iframe deployment did not contain the risk
One of SlowMist’s main findings was that using the chat window inside an iframe did not prevent broader exposure. The firm said the malicious code could still access data from the main page, meaning the compromise was not confined to the support widget itself.
That matters because the attack was not limited to the three crypto sites where address manipulation was observed. SlowMist said credential theft could occur on any resource that had the compromised Udesk widget installed, expanding the possible impact well beyond a small set of named targets.
Address replacement on three crypto platforms
In a separate function, the malware checked page URLs and interface elements to identify deposit pages on three platforms: mgbx[.]com, bikingex[.] and bitxex[.]io. When triggered, it searched for top-up addresses and repeatedly replaced them with attacker-specified values every 200 milliseconds, according to SlowMist.
The firm said the spoofing logic covered addresses for Bitcoin, EVM-compatible networks, TRON, Solana, Litecoin, and Dogecoin. Address recognition was based on pattern matching rather than full network verification, which increased the chance that users could be shown and copy a falsified destination.
SlowMist also found multiple methods for tampering with copied data. The script allegedly intercepted Clipboard API calls, altered copy-button behavior, and modified copy-event contents so that a fake deposit address could be placed into the clipboard even if the visible text being copied appeared unrelated.
Response steps and the immediate next move
SlowMist urged affected companies to stop distributing the compromised scripts and begin checking their systems for signs of intrusion. The firm also recommended revoking compromised credentials because stolen cookies, tokens, and login data could remain useful to attackers after the initial infection is discovered.
For platforms handling deposits, SlowMist said displayed wallet addresses should be verified against trusted server-side data and transaction records. The most immediate confirmed next step from the researchers was containment: remove the tainted scripts, investigate possible account compromise, and validate whether deposit addresses shown to users were altered during the incident.
Source: incrypted.com