Can Steal Data and Replace Deposit Addresses: Udesk Customer Service System Scripts Injected with Malicious Code

Odaily Report: According to SlowMist monitoring, scripts related to the Udesk customer service system have been injected with malicious code. The analyzed JavaScript samples can collect information from cookies, browser local storage, and session storage, as well as sensitive information from forms and authentication requests, potentially leading to the leakage of user sessions and account credentials. The malicious scripts also replace the deposit addresses displayed on specific websites and tamper with clipboard contents, potentially causing deposit funds to be redirected to addresses designated by the attacker. SlowMist recommends that affected websites stop loading the contaminated scripts and restore trusted versions, investigate data exfiltration records, revoke potentially compromised sessions, and replace relevant credentials in a clean environment; users should independently verify deposit addresses and transaction records through trusted channels.