Malicious code in Udesk customer-service scripts steals web session data and swaps crypto deposit addresses, loaded from udeskqlobal[.]com (Oct 2026)
- Scam type: Hack
- Chain: Tron
- Project or site name: Malicious loader in Udesk customer-service scripts (udeskqlobal[.]com)
- Incident date: 2026-10-16
- Reported: 2026-10-27
- Last updated: 2026-10-27
SlowMist reported on 2026-10-27 that malicious code had been injected into scripts associated with the Udesk customer-service system. Per SlowMist, the code steals session data and form input from any page that loads it, and its address-swapping module is configured for three crypto exchange sites named in the code, where it replaces deposit addresses with six attacker addresses, listed below. How it works: SlowMist says a sample named udeskApi.2026-10-16.cached.js ends with a hex-encoded loader that pulls a second script, deeps.js, from udeskqlobal[.]com (spelled with a q). That payload…
Other addresses in this report: bc1qhzppfj69ywp22swj50jwcfxdamg3ym245srng9, 0x9b6ecd0023a28e1391c5124ece578a9751a337b2, TH4L5YAhhxtC8qALbZKbPZZgausbGi25nF, AFmCUe3nNbjTaC585CcdA3vvC9iWVR8YunooFKpaQx2Z, ltc1qwz0zp39ywl34kahvn9lyk7j5x63wsy9tcxhm3w, DAoy2w8uvFtZ92q87s9qKEoHbWgV7mVThj
Websites in this report: udeskqlobal.com