#udesk
udesk
112 views
3 Discussing
Hot
Latest
Tonight's warning breaks the safety check most of us rely on — it stopped me mid-scroll.
SlowMist found malicious code in the Udesk chat widget: a tampered file loading a second script from a lookalike domain, udeskqlobal[.]com, harvesting login data from pages that load it. On deposit pages at MGBX, Biking Exchange and BitxEX, it goes further, swapping displayed deposit addresses every 200 milliseconds for attacker wallets across BTC, EVM chains, Tron, Solana, Litecoin and Dogecoin, and rewriting clipboard copies.
What worries me most: checking the pasted address against the page won't catch it, since both can show the same tampered value. SlowMist hasn't confirmed any funds lost or how the code got in — that part is unknown.
If you use those platforms, verify deposit addresses beyond the page. Context only: $BTC $80,542 (+0.5%/24h), $ETH $2,347 (+1.2%), Binance spot, 23:55 WIB — no reaction tied to this warning. DYOR.
When did you last verify a deposit address elsewhere?
$BTC #CryptoNews #Security #Udesk #SlowMist
Tonight's warning breaks the safety check most of us rely on — it stopped me mid-scroll.
SlowMist found malicious code in the Udesk chat widget: a tampered file loading a second script from a lookalike domain, udeskqlobal[.]com, harvesting login data from pages that load it. On deposit pages at MGBX, Biking Exchange and BitxEX, it goes further, swapping displayed deposit addresses every 200 milliseconds for attacker wallets across BTC, EVM chains, Tron, Solana, Litecoin and Dogecoin, and rewriting clipboard copies.
What worries me most: checking the pasted address against the page won't catch it, since both can show the same tampered value. SlowMist hasn't confirmed any funds lost or how the code got in — that part is unknown.
If you use those platforms, verify deposit addresses beyond the page. Context only: $BTC $80,542 (+0.5%/24h), $ETH $2,347 (+1.2%), Binance spot, 23:55 WIB — no reaction tied to this warning. DYOR.
When did you last verify a deposit address elsewhere?
$BTC #CryptoNews #Security #Udesk #SlowMist
SlowMist found malicious code in the Udesk chat widget: a tampered file loading a second script from a lookalike domain, udeskqlobal[.]com, harvesting login data from pages that load it. On deposit pages at MGBX, Biking Exchange and BitxEX, it goes further, swapping displayed deposit addresses every 200 milliseconds for attacker wallets across BTC, EVM chains, Tron, Solana, Litecoin and Dogecoin, and rewriting clipboard copies.
What worries me most: checking the pasted address against the page won't catch it, since both can show the same tampered value. SlowMist hasn't confirmed any funds lost or how the code got in — that part is unknown.
If you use those platforms, verify deposit addresses beyond the page. Context only: $BTC $80,542 (+0.5%/24h), $ETH $2,347 (+1.2%), Binance spot, 23:55 WIB — no reaction tied to this warning. DYOR.
When did you last verify a deposit address elsewhere?
$BTC #CryptoNews #Security #Udesk #SlowMist
·
--
Article
Customer service chat changes the deposit address every 0.2 seconds: Udesk script targets three exchangesThe customer service chat changes the deposit address every 0.2 seconds: you think you’re just opening it to chat, but your money may already be headed to someone else’s wallet. That’s exactly what the Udesk script caught by SlowMist was doing.
SlowMist discovered it during routine threat intelligence monitoring and alerted customers through MistEye. The tampered file, udeskApi.2026-10-16.cached.js, hides the loader behind legitimate code, with the target written in hexadecimal. After decoding, it fetches a second-stage script, deeps.js, from udeskqlobal.com. Check logs for the spelling with a q.
Once executed, it reads cookies and browser storage, copies form inputs and requests to addresses containing login, signup, or password, and sends them to a server on the same domain. This could let an attacker impersonate users or take over accounts. Even if the hostname isn’t on the list of three exchanges, it first enters the collection path and installs a hook; an iframe-wrapped customer service chat can’t isolate it from scripts on the host page.
Customer service chat changes the deposit address every 0.2 seconds: Udesk script targets three exchanges
The customer service chat changes the deposit address every 0.2 seconds: you think you’re just opening it to chat, but your money may already be headed to someone else’s wallet. That’s exactly what the Udesk script caught by SlowMist was doing.
SlowMist discovered it during routine threat intelligence monitoring and alerted customers through MistEye. The tampered file, udeskApi.2026-10-16.cached.js, hides the loader behind legitimate code, with the target written in hexadecimal. After decoding, it fetches a second-stage script, deeps.js, from udeskqlobal.com. Check logs for the spelling with a q.
Once executed, it reads cookies and browser storage, copies form inputs and requests to addresses containing login, signup, or password, and sends them to a server on the same domain. This could let an attacker impersonate users or take over accounts. Even if the hostname isn’t on the list of three exchanges, it first enters the collection path and installs a hook; an iframe-wrapped customer service chat can’t isolate it from scripts on the host page.
SlowMist discovered it during routine threat intelligence monitoring and alerted customers through MistEye. The tampered file, udeskApi.2026-10-16.cached.js, hides the loader behind legitimate code, with the target written in hexadecimal. After decoding, it fetches a second-stage script, deeps.js, from udeskqlobal.com. Check logs for the spelling with a q.
Once executed, it reads cookies and browser storage, copies form inputs and requests to addresses containing login, signup, or password, and sends them to a server on the same domain. This could let an attacker impersonate users or take over accounts. Even if the hostname isn’t on the list of three exchanges, it first enters the collection path and installs a hook; an iframe-wrapped customer service chat can’t isolate it from scripts on the host page.
393
Log in to explore more content
Join global crypto users on Binance Square
⚡️ Get latest and useful information about crypto.
💬 Trusted by the world’s largest crypto exchange.
👍 Discover real insights from verified creators.
Email / Phone number
Trending Topics
1
#CanMicrosoftDeliverOnAI
74,501 views
726 Discussing
2
#CanGoogleDefindItsCore
39,037 views
539 Discussing
3
#FOMCWatch
9.1M views
27,933 Discussing
4
#EthereumDropsBelow$2300
10,716 views
157 Discussing
5
#BitcoinSlipsBelow$80KAgain
30,151 views
119 Discussing
6
#ThailandLaunchesWORPTStablecoinToQRPaymentApp
61,136 views
787 Discussing
7
#StrategySkipsBitcoinPurchasesSpends$205MOnSTRCBuybacks
11,628 views
98 Discussing
8
#BitmineAdds10452ETH
105,657 views
1,184 Discussing
9
#SouthKoreaConsidersEducationTaxOnCryptoExchanges
62,531 views
840 Discussing
10
#OCCUrgesCommunityBanksToEnterStablecoinPayments
43,120 views
600 Discussing