Hidden Code in Udesk Chat Script Swaps Crypto Deposit Addresses, SlowMist Says

JavaScript tied to Udesk , a customer service chat widget that websites embed on their pages, carried code that collected visitors’ login data and replaced crypto deposit addresses on at least three trading sites, according to blockchain security firm SlowMist . SlowMist published its analysis on Tuesday after its team spotted the code during routine threat intelligence work. The firm said its MistEye monitoring service pushed alerts to its customers. The tampered file, udeskApi.2026-10-16.cached.js , hid a short loader after the widget’s normal code. Its target was written in hexadecimal, so a search for the plain-text domain could miss it.