The company disclosed its findings on 27 October after examining two JavaScript samples obtained during routine threat monitoring. Its investigation identified separate mechanisms for collecting sensitive browser data and manipulating payment destinations on three cryptocurrency trading websites.
SlowMist said the compromised file, named udeskApi.2026-10-16. cached. js, contained an additional loader concealed within otherwise functional customer-service code. The injected component fetched a second file, deeps. js, from a suspicious domain designed to resemble a legitimate Udesk address.
The domain, udeskqlobal. com, uses the letter q in qlobal. The loader encoded its destination in hexadecimal characters, making the external connection less obvious to investigators searching the original script for readable website addresses.
Once executed, the additional code could read cookies accessible to JavaScript, along with information held in localStorage and sessionStorage. These browser storage facilities can contain account details and authentication tokens, although cookies protected by the HttpOnly setting cannot be read through the method identified.
The payload also monitored submitted forms and selected authentication requests. SlowMist found that it could capture information entered into login fields and intercept requests containing terms associated with signing in, registration or passwords. Collected material was directed towards a receiving endpoint on the suspicious domain.
Such access could enable unauthorised use of active sessions or account takeovers where usable credentials or tokens were exposed. SlowMist did not establish how many users had their information collected or whether attackers successfully entered any accounts.
The data collection component presented a broader exposure than the cryptocurrency address manipulation. SlowMist determined that collection routines could run on pages loading the affected script even when those pages did not match the three trading websites configured for address replacement.
The targeted address-changing functionality applied to MGBX, Biking Exchange and BitxEX, according to the analysis. On matching deposit pages, the code repeatedly searched for wallet addresses and substituted predetermined destinations associated with Bitcoin, Ethereum-compatible networks, Tron, Solana, Litecoin and Dogecoin.
The scanning routine operated at intervals of 200 milliseconds. Its purpose was to overwrite addresses appearing in the page, including content that might change after the initial website load. Transfers made to substituted addresses could consequently reach destinations different from those intended by customers.
The malicious script also interfered with copying addresses. It modified clipboard operations, replaced selected copy buttons and intercepted copy events, creating circumstances in which both the address visible on a webpage and the address pasted elsewhere could show the same substituted value.
SlowMist cautioned that comparing copied text against an already compromised page would therefore offer insufficient assurance. Its examination also identified implementation limitations in parts of the malicious code, meaning individual manipulation techniques might not operate identically on every website or browser.
The investigation did not determine the original route by which the malicious code entered the customer-service script. It also did not quantify affected websites, confirm financial losses or establish that every installation of Udesk software was compromised. The findings concern the examined scripts rather than a demonstrated compromise of all Udesk services.
The company also identified an alternative transmission route using image requests when the principal data transfer failed. That mechanism could send information through a different browser network channel, complicating attempts to detect leakage by examining only conventional outgoing requests. SlowMist advised checking both request bodies and query parameters when reviewing potentially affected traffic.
Its technical analysis noted that customer-service chat windows displayed within embedded frames do not automatically protect the surrounding website. Scripts executed in the host page can still interact with information available in that page’s own context.
SlowMist urged website operators distributing affected files to preserve technical evidence, stop serving compromised resources and restore independently verified versions. It recommended examining hosting arrangements, content delivery networks and script management systems to identify possible points of alteration.
Operators were also advised to inspect network records for suspicious transfers, revoke potentially exposed sessions and replace passwords or authentication tokens from clean environments. Simply removing a script reference would not necessarily stop malicious functions already running inside an open browser page.
For cryptocurrency services, the company recommended checking deposit destinations against trusted backend records and reviewing completed transactions. Its MistEye monitoring platform distributed alerts and incorporated the identified malicious files and indicators into its threat detection capabilities.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
