Udesk’s developer documentation shows websites embedding its chat service by loading `udeskApi.js` into their webpages. SlowMist said an added function at the end of the analyzed customer-service script decoded a hexadecimal URL and inserted another script to load `deeps.js` asynchronously from `udeskqlobal[.]com`—spelled with a “q.”
According to the firm, that remote script runs in the context of the document loading it. A chat interface’s use of an iframe does not by itself isolate scripts loaded into the host page.
Data Collection Reaches Beyond Address-Swap Targets
SlowMist said the payload reads JavaScript-accessible cookies, `localStorage` and `sessionStorage`, which can contain login tokens and other account data. It also captures non-empty form fields and copies the bodies of certain authentication-related network requests. Reusable login tokens could enable session impersonation, while passwords and verification codes entered on the page could also be exposed, the firm said.
Cookies protected by the `HttpOnly` attribute are excluded from this cookie-reading path. That limitation is consistent with MDN’s browser documentation, which explains that the attribute prevents JavaScript from accessing a cookie’s value.
The data-collection routines run before the script checks whether a hostname matches its address-swapping configuration, SlowMist found. Consequently, the data risk is not limited to those three site patterns wherever the payload executes.
SlowMist identified `udeskqlobal[.]com/c.php` as the collection endpoint. The code sends data through POST requests and attempts an image-request fallback if transmission encounters an error.
For address replacement, the analysis describes page rules looking for terms including `deposit`, `recharge` and `assets`. When the relevant page, element and address-format conditions match, the code substitutes configured values labeled BTC, EVM, TRON, Solana, LTC and DOGE. Its clipboard manipulation has separate triggers, including a Clipboard API wrapper that does not require the deposit-page conditions to match, SlowMist said.
SlowMist urged operators to preserve evidence, stop distributing affected resources and restore trusted versions. It recommended closing exposed pages, revoking affected sessions and rotating exposed credentials from a clean environment. Deposit destinations and transactions should be checked against trusted backends and transaction records: removing a script tag alone does not undo the hooks and timers already installed, the firm warned.
thedefiant.io
