Udesk Script Attack Risks Data Theft and Crypto Deposits
SlowMist identified malicious JavaScript injected into scripts linked to Udesk customer service. The Udesk script attack, hosted on udeskqlobal[.]com, could collect accessible cookies, browser storage and information entered into forms or authentication requests, potentially exposing credentials and account sessions. It could also target deposit pages on three websites, replace displayed cryptocurrency addresses and interfere with clipboard functions, redirecting transfers to attacker-controlled wallets. Data was sent to a remote server, with an image-request fallback if the main transmission failed. SlowMist published file hashes and six wallet addresses as indicators of compromise. It advised affected services to stop loading compromised scripts, restore trusted versions, investigate access logs and possible data leaks, revoke exposed sessions, and verify deposits and transactions. Users should check deposit addresses through independent, trusted channels.
Neutral
The reports describe a serious security and operational threat, but do not name any cryptocurrency or provide evidence of broad market disruption. Address substitution could cause direct losses for users and undermine confidence in affected services, potentially prompting short-term caution around deposits and trading on those platforms. However, any impact is likely to be concentrated on the targeted websites rather than the price of a specific crypto asset. Over the longer term, remediation, session revocation and stronger script and address verification may limit further harm. With no named token or market-wide evidence, the expected price impact on a particular cryptocurrency is neutral.