🚨 Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Deposit Addresses @SlowMist_Team recently detected an attack involving malicious code injected into scripts associated with the #Udesk# customer service system during routine threat intelligence investigations. We obtained and analyzed two #JavaScript# samples to trace how the malicious code was loaded into webpages and executed. 🔍 Further analysis revealed two key malicious behaviors: 🔹 The malicious script collects cookies, localStorage, sessionStorage, and sensitive information submitted through forms and authentication requests, potentially exposing user sessions and account credentials. 🔹 The script replaces deposit addresses displayed on specific websites and tampers with clipboard contents, potentially redirecting deposits to substituted recipient addresses. MistEye ( SlowMist’s Web3 threat intelligence system, promptly disseminated the relevant risk information through its intelligence push and customer alert channels.🫡 🛡️ Recommendations: Stop serving compromised scripts and restore trusted versions. Investigate data exfiltration records, revoke potentially exposed sessions, and rotate potentially exposed credentials from a clean environment. Independently verify deposit addresses and transaction records through trusted channels. Read the full analysis 👇