Hidden Code in Udesk Chat Script Swaps Crypto Deposit Addresses, SlowMist Says

JavaScript tied to Udesk , a customer service chat widget that websites embed on their pages, carried code that collected visitors’ login data and replaced crypto deposit addresses on at least three trading sites, according to blockchain security firm SlowMist . SlowMist published its analysis on Tuesday after its team spotted the code during routine threat intelligence work. The firm said its MistEye monitoring service pushed alerts to its customers. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . How the Script Worked The tampered file, udeskApi.2026-10-16.cached.js , hid a short loader after the widget’s normal code. Its target was written in hexadecimal, so a search for the plain-text domain could miss it. Decoded, it pulled a second script, deeps.js , from udeskqlobal[.]com .

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Unchained.