SlowMist 披露 Udesk 客服系统脚本被注入恶意 JS，可窃取数据并替换充值地址

🚨 Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Deposit Addresses @SlowMist_Team recently detected an attack involving malicious code injected into scripts associated with the #Udesk customer service system during routine threat intelligence investigations. We obtained and analyzed two #JavaScript samples to trace how the malicious code was loaded into webpages and executed. 🔍 Further analysis revealed two key malicious behaviors: 🔹 The malicious script collects cookies, localStorage, sessionStorage, and sensitive information submitted through forms and authentication requests, potentially exposing user sessions and account credentials. 🔹 The script replaces deposit addresses displayed on specific websites and tampers with clipboard contents, potentially redirecting deposits to substituted recipient addresses. MistEye (http://misteye.io), SlowMist’s Web3 threat intelligence system, promptly disseminated the relevant risk information through its intelligence

来源：SlowMist_Team · x.com