SlowMist’s cybersecurity team discovered the attack while analyzing two files linked to the Udesk customer support system. The findings matter because SlowMist said the injected code could steal login details and other user data across sites using the compromised widget, while also redirecting cryptocurrency deposits on three platforms.

According to SlowMist, attackers covertly embedded code that loaded a malicious script called deeps.js from the fake domain udeskqlobal[.]com. The domain differed from the original by one letter, using “q” instead of “g.”

The malware operated in several stages. It first read browser cookies and data from localStorage and sessionStorage in an attempt to steal active authorization tokens, which could allow attackers to access user accounts without entering a password.

At the same time, the script intercepted information that visitors entered into website forms, SlowMist said. The collected data included names, passwords, verification codes and information submitted through login or registration requests.

The script sent the information to the attackers’ server. If browser protections blocked standard transmission, the code used obfuscation by encrypting the data inside a request to load an ordinary image, according to the researchers.

SlowMist said displaying the chat window in an iframe did not protect websites because the malicious code could still access data from the entire main page. The researchers also said credential harvesting occurred on all resources where the compromised Udesk widget was installed, rather than only on specifically targeted platforms.

Deposit address and clipboard manipulation

A separate module handled deposit-address replacement and intercepted copy operations, SlowMist said. The code contained rules for three domains: mgbx[.]com, bikingex[.], and bitxex[.]io.

The script checked the page URL and relevant interface elements, then searched for deposit addresses every 200 milliseconds and replaced them with addresses specified by the attackers.

The code included addresses for six asset types: BTC, EVM-compatible networks, TRON, Solana, LTC and DOGE. It identified addresses through character patterns without verifying the network selected by the user or other transaction parameters.

SlowMist said the process created a risk that users could copy spoofed addresses and send funds directly to the attackers.

The script also interfered with clipboard operations in three ways: intercepting Clipboard API calls, replacing copy buttons and modifying the contents of copy events. As a result, a fake address could appear in the clipboard even when a user attempted to copy other text, according to SlowMist.

Recommendations

Following its investigation, SlowMist urged companies using the compromised scripts to stop distributing them and check their systems for signs of compromise. The researchers also recommended revoking compromised credentials and verifying deposit addresses against trusted server-side data and transaction records.

Hardware cryptocurrency wallet maker Keystone had previously reported a customer data leak.

Source: Incrypted