🚨 Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Deposit Addresses @SlowMist_Team recently detected an attack involving malicious code injected into scripts associated with the #Udesk# customer service system during routine threat intelligence investigations. We obtained and analyzed two #JavaScript# samples to trace how the malicious code was loaded into webpages and executed. 🔍 Further analysis revealed two key malicious behaviors: 🔹 The malicious script collects cookies, localStorage, sessionStorage, and sensitive information submitted through forms and authentication requests, potentially exposing user sessions and account credentials. 🔹 The script replaces deposit addresses displayed on specific websites and tampers with clipboard contents, potentially redirecting deposits to substituted recipient addresses. MistEye ( SlowMist’s Web3 threat intelligence system, promptly disseminated the relevant risk information through its intelligence push and customer alert channels.🫡 🛡️ Recommendations: Stop serving compromised scripts and restore trusted versions. Investigate data exfiltration records, revoke potentially exposed sessions, and rotate potentially exposed credentials from a clean environment. Independently verify deposit addresses and transaction records through trusted channels. Read the full analysis 👇

Kalshi Chief Risk Officer, Udesh Jha, explains why perps are the best option for traders. "Compared to what incumbents do, perps give traders better risk management with a fair price, so we don't see ourselves competing with other products."

"3 random dudes” 1. hacked apple, again and again. 2. your github enterprise is our github enterprise. 3. get a discord message from me, get pwned. 4. oh yeah, at one point we basically had shells across the electron ecosystem. check the DEF CON research. 5. your supabase database is my database. 6. we got the posthog prod database. 7. react2shell? vercel paid us $170k for helping secure their waf. 8. your palo alto vpn is my vpn. 9. ai ides? we got shells for you, antigravity 10. windsurf rce. 11. turning cluely into malware. 12. ai browsers? sure, uxss: your perplexity browser is my browser. 13. openai atlas too. kinda uxss 14. hey, it’s not even our first time hacking discourse. 15. adobe coldfusion: pre-auth rce. because apparently we needed another one. there’s a lot more. go dig. anyway, yes: “3 random dudes.” and @HacktronAI is full of more random dudes like these.