Udesk Support Script Injected: Session Theft and Deposit-Address Swaps

Unknown. No loss figure published.

Root cause: Per SlowMist: malicious code was injected into a Udesk customer-service script (udeskApi.2026-10-16.cached.js) that loads deeps.js from the lookalike domain udeskqlobal[.]com. The payload steals cookies, session data and login credentials and hijacks crypto deposit addresses and clipboard contents. How the script was modified: Unknown.

Timeline, as sourced: Malicious file named udeskApi.2026-10-16.cached.js; SlowMist intel record SM-2026-759682 dated 23 Oct 2026 18:05 (timezone not shown); public disclosure 27 Oct 10:50 UTC. Start date Unknown.

Disclosed 27 Oct 2026. Udesk is a customer-service widget vendor; affected sites load its script on their pages.

Per SlowMist (post and intel card (opens in a new tab)): malicious code was injected into a Udesk customer-service script (udeskApi.2026-10-16.cached.js), which loads deeps.js from the lookalike domain udeskqlobal[.]com (q, not g). The payload steals cookies, session data and login credentials, and hijacks cryptocurrency deposit addresses and clipboard contents while keeping the page working. SlowMist lists BTC, ETH, TRON, SOL, LTC and DOGE attacker addresses and file hashes as IOCs; exfiltration goes to udeskqlobal[.]com/c[.]php.

SlowMist's advice, as reported: stop serving the script, restore a trusted version, revoke sessions and rotate credentials from a clean machine, and verify deposit addresses through a trusted backend. Users: check a deposit address against a second channel before sending.

Unknown: how the script was modified (vendor CDN versus a site's copy), which sites served it, and losses. No Udesk statement found.

Pattern: a third-party widget runs with the same access as your own code.