SlowMist Finds Data-Stealing and Address-Swapping Code in Udesk Scripts

Udesk is a customer-service chat widget that websites embed on their pages, and this case sits at the point where third-party site tools become part of a crypto user’s security surface. SlowMist published its analysis after spotting the code during routine threat-intelligence work, which places the finding in the everyday supply chain of website software rather than in a single exchange or wallet app. For crypto users, that means the trust boundary can extend to ordinary support widgets that sit on a trading site’s page.

The immediate practical impact is on deposit flows at trading sites, where a changed address can send funds to the wrong destination if a user does not catch the substitution. Site operators that embed Udesk would have to review what their pages load and how deposit addresses are rendered and copied. Users would need to treat the address field itself as something that can be manipulated at the interface level, not just in the clipboard. (per thedefiant.io)

This case shows how a small snippet of front-end code can sit between a user and a crypto transfer, which is a direct tension with the idea that users can verify destinations for themselves. The fact that the payload also gathered data beyond the three targeted sites raises the risk that one embedded script can reach beyond a narrow set of victims. That makes third-party web tooling a security and governance problem for exchanges and other trading platforms, not just a browser issue.

Still open is where the compromised code entered Udesk’s distribution path, how many websites loaded it, and whether all affected operators removed it at the same time. It is also not yet clear from these details whether any deposits were actually redirected or only that the code had that capability. SlowMist’s disclosure establishes the presence of the script, but the scope of real-world harm remains unsettled.