Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Transfer Addresses

Key points

• SlowMist reported that malicious JavaScript injected into Udesk customer service scripts collected user data and altered deposit addresses and copied content per site-specific rules.
• Analysts said a hex-encoded loader in udeskApi.2026-10-16.cached.js fetched deeps.js from a lookalike domain spelled with "qlobal", executing within the embedding page context.
• According to the analysis, the payload read cookies and web storage, hooked form submissions, fetch and XHR authentication requests, and posted data to a fixed endpoint.

AI summary of SlowMist’s report, written only from the publisher’s text. Read the original for full context.